@fluid-app/fluid-cli-portal 0.1.52 → 0.1.53

package/dist/index.mjs

@@ -1,18 +1,18 @@
-import { A as fluid_os_v0_create_fluid_osversion, B as fluid_os_v0_update_fluid_osnavigation, C as writeMappings, D as fluid_os_v0_create_fluid_osprofile, E as fluid_os_v0_create_fluid_osnavigation_item, F as fluid_os_v0_delete_fluid_osscreen, G as fluid_os_v0_update_fluid_osversion, H as fluid_os_v0_update_fluid_osprofile, I as fluid_os_v0_delete_fluid_ostheme, K as createFetchClient, L as fluid_os_v0_list_fluid_osdefinitions, M as fluid_os_v0_delete_fluid_osnavigation, N as fluid_os_v0_delete_fluid_osnavigation_item, O as fluid_os_v0_create_fluid_osscreen, P as fluid_os_v0_delete_fluid_osprofile, R as fluid_os_v0_list_fluid_osnavigation_items, S as updateMapping, T as fluid_os_v0_create_fluid_osnavigation, U as fluid_os_v0_update_fluid_osscreen, V as fluid_os_v0_update_fluid_osnavigation_item, W as fluid_os_v0_update_fluid_ostheme, _ as deriveSlug, a as buildThemeIdToSlugMap, b as resolveIdToSlug, c as transformNavigationItems, d as transformTheme, f as buildSnapshot, g as writeSnapshot, h as readSnapshot, i as buildNavigationIdToSlugMap, j as fluid_os_v0_create_widget_package_version, k as fluid_os_v0_create_fluid_ostheme, l as transformProfile, m as diffAgainstSnapshot, o as deriveScreenSlug, p as computeFileHash, r as buildIdToSlugMap, s as transformNavigation, t as pullCommand, u as transformScreen, v as readMappings, w as fluid_os_v0_complete_widget_package_version_upload, x as resolveSlugToId, y as removeMapping, z as fluid_os_v0_list_fluid_osversions } from "./pull-XOsFaqz2.mjs";
+import { A as fluid_os_v0_create_fluid_ostheme, B as fluid_os_v0_list_fluid_osversions, C as writeMappings, D as fluid_os_v0_create_fluid_osnavigation_item, E as fluid_os_v0_create_fluid_osnavigation, F as fluid_os_v0_delete_fluid_osprofile, G as fluid_os_v0_update_fluid_ostheme, H as fluid_os_v0_update_fluid_osnavigation_item, I as fluid_os_v0_delete_fluid_osscreen, K as fluid_os_v0_update_fluid_osversion, L as fluid_os_v0_delete_fluid_ostheme, M as fluid_os_v0_create_widget_package_version, N as fluid_os_v0_delete_fluid_osnavigation, O as fluid_os_v0_create_fluid_osprofile, P as fluid_os_v0_delete_fluid_osnavigation_item, R as fluid_os_v0_list_fluid_osdefinitions, S as updateMapping, T as fluid_os_v0_complete_widget_package_version_upload, U as fluid_os_v0_update_fluid_osprofile, V as fluid_os_v0_update_fluid_osnavigation, W as fluid_os_v0_update_fluid_osscreen, _ as deriveSlug, a as buildThemeIdToSlugMap, b as resolveIdToSlug, c as transformNavigationItems, d as transformTheme, f as buildSnapshot, g as writeSnapshot, h as readSnapshot, i as buildNavigationIdToSlugMap, j as fluid_os_v0_create_fluid_osversion, k as fluid_os_v0_create_fluid_osscreen, l as transformProfile, m as diffAgainstSnapshot, o as deriveScreenSlug, p as computeFileHash, q as createFetchClient, r as buildIdToSlugMap, s as transformNavigation, t as pullCommand, u as transformScreen, v as readMappings, w as atomicWriteFile, x as resolveSlugToId, y as removeMapping, z as fluid_os_v0_list_fluid_osnavigation_items } from "./pull-C3yj9L07.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import chalk from "chalk";
 import ora from "ora";
-import path, { basename, dirname, join, relative, resolve } from "node:path";
+import path, { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
+import { chmodSync, constants, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { copyFile, lstat, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
+import os, { tmpdir } from "node:os";
 import { failure, findProjectConfig, getActiveProfile, getAuthToken, listProfileNames, readConfig, success } from "@fluid-app/fluid-cli";
 import prompts from "prompts";
-import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import Handlebars from "handlebars";
 import { execa } from "execa";
-import os from "node:os";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import fs from "fs-extra";
 //#region src/types.ts
 /**
@@ -95,9 +95,9 @@ async function promptProjectConfig(projectName, options) {
 //#endregion
 //#region src/utils/file-system.ts
 const _currentDir$1 = dirname(fileURLToPath(import.meta.url));
-const EMBEDDED_PORTAL_SDK_VERSION = "0.1.461";
+const EMBEDDED_PORTAL_SDK_VERSION = "0.1.462";
 const EMBEDDED_CLI_CORE_VERSION = "0.1.14";
-const EMBEDDED_CLI_PORTAL_VERSION = "0.1.52";
+const EMBEDDED_CLI_PORTAL_VERSION = "0.1.53";
 /**
 * Find the package root by walking up from the current directory to the nearest package.json.
 * Works whether running from dist/ (bundled) or src/utils/ (tsx dev mode).
@@ -296,6 +296,40 @@ async function getCliVersion() {
 async function getPortalCliVersion() {
 	return getTemplatePackageVersion(["cli", "portal"], EMBEDDED_CLI_PORTAL_VERSION);
 }
+const NPM_REGISTRY_URL = "https://registry.npmjs.org";
+const NPM_REGISTRY_TIMEOUT_MS = 5e3;
+/**
+* Clamp a scaffold dependency pin to a version that `pnpm install` can
+* actually resolve from the registry.
+*
+* The versions above are whatever this CLI build carries — embedded at build
+* time, or read from the workspace when running from source. Both run ahead
+* of npm whenever the monorepo holds a release bump that has not been
+* published yet (routine for anyone running the CLI from a checkout, e.g.
+* Mist in development), and a scaffold pinned to that version fails to
+* install. Only a definitive registry 404 for the exact version downgrades
+* the pin to the registry's `latest`; a network failure or any other registry
+* response keeps the original version, so offline scaffolds behave exactly as
+* before.
+*
+* Scaffold pins are the ONLY sound callsite: consumers that report which
+* version is running (e.g. widget-package-publish) must not route through
+* this — it would silently misreport an unpublished build as the older
+* published one.
+*/
+async function resolveInstallableTemplateVersion(packageName, version) {
+	try {
+		if ((await fetch(`${NPM_REGISTRY_URL}/${packageName}/${encodeURIComponent(version)}`, { signal: AbortSignal.timeout(NPM_REGISTRY_TIMEOUT_MS) })).status !== 404) return version;
+		const latest = await fetch(`${NPM_REGISTRY_URL}/${packageName}/latest`, { signal: AbortSignal.timeout(NPM_REGISTRY_TIMEOUT_MS) });
+		if (!latest.ok) return version;
+		const pkg = await latest.json();
+		if (typeof pkg.version !== "string") return version;
+		console.warn(`${packageName}@${version} is not published yet; the scaffold pins the latest published version ${pkg.version} instead.`);
+		return pkg.version;
+	} catch {
+		return version;
+	}
+}
 async function getTemplatePackageVersion(packagePathSegments, embeddedVersion) {
 	if (embeddedVersion) return embeddedVersion;
 	try {
@@ -486,6 +520,10 @@ function splitRemoteCredentials(remoteUrl) {
 		password
 	};
 }
+/** Strip credential userinfo from a minted remote URL for safe comparison. */
+function cleanGitRemoteUrl(remoteUrl) {
+	return splitRemoteCredentials(remoteUrl).cleanUrl;
+}
 /**
 * Write a stub GIT_ASKPASS shell script to a per-process tmpdir and
 * return its path. The script contains no secret — it echoes back
@@ -519,9 +557,9 @@ function ensureAskpassScript() {
 *     credentials are empty (auth should fail fast, not hang).
 */
 function gitAuthSpawn(remoteUrl) {
-	const { cleanUrl, username, password } = splitRemoteCredentials(remoteUrl);
+	const { username, password } = splitRemoteCredentials(remoteUrl);
 	return {
-		cleanUrl,
+		cleanUrl: cleanGitRemoteUrl(remoteUrl),
 		env: {
 			...process.env,
 			GIT_ASKPASS: ensureAskpassScript(),
@@ -791,6 +829,245 @@ async function gitMergeFastForward(cwd) {
 	}
 }
 /**
+* Local-only state that must never reach a portal's provisioned repo,
+* regardless of which tool created the checkout.
+*
+* `.mist-desktop/` is Mist Desktop's per-machine working state for the
+* project directory it opened — chat transcripts, user attachments,
+* screenshots, source baselines, and a media cache. When Desktop drives
+* `fluid portal push`, that directory sits in the project root, so a
+* whole-tree `git add -A` publishes every private conversation to the
+* portal's GitHub repo. `.mist` is the sibling clone marker (a slug
+* pointer); committing it means a later revert deletes it and breaks
+* slug resolution for every subsequent command.
+*
+* Neither is portal content: the portal's own material lives under
+* `portal/` and is pushed separately by the content push.
+*/
+const LOCAL_ONLY_GIT_PATHS = [".mist", ".mist-desktop/"];
+/**
+* Append {@link LOCAL_ONLY_GIT_PATHS} to `.git/info/exclude` when absent.
+*
+* Why the local exclude and not `.gitignore`: a portal's `.gitignore`
+* ships from the starter template (bundled or the GitHub
+* `portal-template` repo), so a template edit alone would never reach
+* the clones that already exist on people's machines. `.git/info/exclude`
+* is per-checkout, so writing it here — at sync time, on every push —
+* heals a pre-existing clone on its very next push with no template
+* release required. The template is updated too, for fresh scaffolds.
+*
+* Idempotent and best-effort: never throws. A repo with an unusual `.git`
+* layout (missing `info/`, `.git` as a worktree pointer file) just skips
+* the exclude — {@link gitAutoCommit} also cleans these paths out of the
+* index after staging, so the exclude is a convenience, not the only
+* defense.
+*
+* Mirrors `packages/cli/mist/src/lib/git.ts::excludeMistMarkerFromGit`.
+*/
+function excludeLocalStateFromGit(cwd) {
+	try {
+		const gitDir = path.join(cwd, ".git");
+		if (!existsSync(gitDir)) return;
+		const infoDir = path.join(gitDir, "info");
+		if (!existsSync(infoDir)) mkdirSync(infoDir, { recursive: true });
+		const excludePath = path.join(infoDir, "exclude");
+		const existing = existsSync(excludePath) ? readFileSync(excludePath, "utf8") : "";
+		const existingLines = new Set(existing.split("\n").map((line) => line.trim()).filter(Boolean));
+		const missing = LOCAL_ONLY_GIT_PATHS.filter((entry) => !existingLines.has(entry));
+		if (missing.length === 0) return;
+		writeFileSync(excludePath, `${existing}${existing.length > 0 && !existing.endsWith("\n") ? "\n" : ""}${missing.join("\n")}\n`, "utf8");
+	} catch {}
+}
+/**
+* Absolute path of the repository containing `cwd`, or `cwd` itself when
+* resolution fails (not a repo / git missing — the caller's own git
+* command surfaces the real error).
+*
+* Every local-state defense must anchor here rather than to `cwd`: a push
+* run from a project subdirectory would otherwise look for
+* `<subdir>/.git`, silently skip the exclude write, and then let
+* `git add -A` — which always stages the WHOLE repository — sweep the
+* root `.mist-desktop/` into the commit anyway.
+*/
+async function resolveRepoRoot(cwd) {
+	try {
+		const { stdout } = await execa("git", ["rev-parse", "--show-toplevel"], { cwd });
+		const root = stdout.trim();
+		if (root.length > 0) return root;
+	} catch {}
+	return cwd;
+}
+/**
+* Repository-root-anchored {@link excludeLocalStateFromGit}, for callers
+* that only have a possibly-nested `cwd`.
+*
+* Run this BEFORE any working-tree cleanliness check, not just before
+* staging: while `.mist-desktop/` is neither tracked nor excluded, it
+* shows up as untracked in `git status --porcelain`, so a Desktop-driven
+* push reads as "you have uncommitted changes" and the sync skips with
+* advice to `git pull` that the user can't act on. Excluding it first
+* makes the cleanliness check reflect actual portal changes.
+*/
+async function ensureLocalStateExcluded(cwd) {
+	excludeLocalStateFromGit(await resolveRepoRoot(cwd));
+}
+/** Paths currently tracked under `.mist-desktop/`, or [] when none. */
+async function trackedLocalStatePaths(repoRoot) {
+	try {
+		const { stdout } = await execa("git", [
+			"ls-files",
+			"--",
+			".mist-desktop"
+		], { cwd: repoRoot });
+		return stdout.split("\n").filter((l) => l.trim().length > 0);
+	} catch {
+		return [];
+	}
+}
+/**
+* Untrack private Mist Desktop state and, if anything was tracked,
+* commit ONLY that removal so the next push deletes it from the remote.
+* Returns true when a purge commit was made.
+*
+* Call this on every sync BEFORE deciding whether there is anything to
+* auto-commit — a clean checkout that already tracks `.mist-desktop/`
+* still needs the removal, and ignore rules alone cannot untrack an
+* existing path.
+*
+* The commit is built through a THROWAWAY index (`GIT_INDEX_FILE`), not
+* the user's: `read-tree HEAD` → `rm --cached` → `write-tree` →
+* `commit-tree` → `update-ref`. A plain `git commit` would capture the
+* user's entire index, so anything they had pre-staged would be swept
+* into the purge commit and pushed — defeating `--no-commit` and
+* mislabelling their work. A pathspec commit (`git commit -- .mist-desktop`)
+* is also wrong: with `--only` git takes the *working tree* content of
+* those paths, and the chats are still on disk, so it would re-add
+* exactly what we are removing.
+*
+* The user's real index is then updated with the same `rm --cached`,
+* touching only this path — so any other staged work stays staged, and
+* the working tree is never modified.
+*/
+async function purgeLocalStateFromIndex(cwd, message) {
+	const repoRoot = await resolveRepoRoot(cwd);
+	if ((await trackedLocalStatePaths(repoRoot)).length === 0) return false;
+	let head;
+	try {
+		const { stdout } = await execa("git", ["rev-parse", "HEAD"], { cwd: repoRoot });
+		head = stdout.trim();
+		if (!head) return false;
+	} catch {
+		return false;
+	}
+	const tmpIndex = path.join(os.tmpdir(), `fluid-portal-purge-${process.pid}-${randomUUID()}.index`);
+	const indexEnv = {
+		...process.env,
+		GIT_INDEX_FILE: tmpIndex
+	};
+	let commitSha;
+	try {
+		await execa("git", ["read-tree", head], {
+			cwd: repoRoot,
+			env: indexEnv
+		});
+		await execa("git", [
+			"rm",
+			"-q",
+			"-r",
+			"--cached",
+			"--ignore-unmatch",
+			"--",
+			".mist-desktop"
+		], {
+			cwd: repoRoot,
+			env: indexEnv
+		});
+		const { stdout: tree } = await execa("git", ["write-tree"], {
+			cwd: repoRoot,
+			env: indexEnv
+		});
+		const { stdout: sha } = await execa("git", [
+			"commit-tree",
+			tree.trim(),
+			"-p",
+			head,
+			"-m",
+			message
+		], {
+			cwd: repoRoot,
+			env: {
+				...indexEnv,
+				...await identityEnv(repoRoot)
+			}
+		});
+		commitSha = sha.trim();
+		if (!commitSha) return false;
+	} catch (err) {
+		const missing = gitMissingError(err);
+		if (missing) throw missing;
+		throw toGitError(err, "purge local state");
+	} finally {
+		rmSync(tmpIndex, { force: true });
+	}
+	try {
+		await execa("git", [
+			"update-ref",
+			"HEAD",
+			commitSha,
+			head
+		], { cwd: repoRoot });
+	} catch (err) {
+		throw toGitError(err, "purge local state");
+	}
+	try {
+		await execa("git", [
+			"rm",
+			"-q",
+			"-r",
+			"--cached",
+			"--ignore-unmatch",
+			"--",
+			".mist-desktop"
+		], { cwd: repoRoot });
+	} catch {}
+	return true;
+}
+/** `GIT_{AUTHOR,COMMITTER}_*` overrides for `commit-tree`, which (unlike
+*  `git commit`) fails outright rather than prompting when the repo has
+*  no identity. Only set what the repo itself doesn't define. */
+async function identityEnv(cwd) {
+	const env = {};
+	const read = async (key) => {
+		try {
+			return (await execa("git", ["config", key], { cwd })).stdout.trim().length > 0;
+		} catch {
+			return false;
+		}
+	};
+	if (!await read("user.name")) {
+		env["GIT_AUTHOR_NAME"] = "Fluid Portal CLI";
+		env["GIT_COMMITTER_NAME"] = "Fluid Portal CLI";
+	}
+	if (!await read("user.email")) {
+		env["GIT_AUTHOR_EMAIL"] = "portal@fluid.app";
+		env["GIT_COMMITTER_EMAIL"] = "portal@fluid.app";
+	}
+	return env;
+}
+/** Shared `-c user.*` args: use the repo's identity, else a synthetic
+*  Fluid bot identity so the commit isn't rejected. */
+async function resolveIdentityArgs(cwd) {
+	let hasName = false;
+	let hasEmail = false;
+	try {
+		hasName = (await execa("git", ["config", "user.name"], { cwd })).stdout.trim().length > 0;
+	} catch {}
+	try {
+		hasEmail = (await execa("git", ["config", "user.email"], { cwd })).stdout.trim().length > 0;
+	} catch {}
+	return [...hasName ? [] : ["-c", "user.name=Fluid Portal CLI"], ...hasEmail ? [] : ["-c", "user.email=portal@fluid.app"]];
+}
+/**
 * `git add -A && git commit -m <message>` (or, with
 * `{ ignoreRemovals: true }`, `git add --ignore-removal .` — see
 * GitAutoCommitOptions).
@@ -803,11 +1080,42 @@ async function gitMergeFastForward(cwd) {
 * `node_modules/`, `dist/`, `.portal-sync/`, logs, `*.tsbuildinfo`), so
 * generated output and local secrets stay out of the commit.
 *
+* That boundary is not enough on its own for tool-local state written
+* INTO the project directory by whatever opened it — most importantly
+* Mist Desktop's `.mist-desktop/` (private chats, attachments,
+* screenshots) and the `.mist` clone marker. A `.gitignore`-only fix
+* can't reach clones that already exist, so this applies belt AND
+* suspenders, all anchored to the repository root (see
+* {@link resolveRepoRoot}):
+*
+*   1. {@link excludeLocalStateFromGit} — idempotent `.git/info/exclude`
+*      write, so `git add` never picks the paths up in the first place.
+*      Heals pre-existing clones on their next push.
+*   2. `git reset -- ':(top).mist' .mist` after staging — unstages the
+*      marker if step 1 silently failed. We deliberately do NOT pass a
+*      `:(exclude)` pathspec to `git add`: when the path is *also*
+*      listed in `.git/info/exclude`, git exits 1 with "paths are
+*      ignored by one of your .gitignore files", turning the normal
+*      (already-healed) case into a hard failure. Add-then-reset is a
+*      no-op when there's nothing staged.
+*   3. `git rm --cached -r --ignore-unmatch .mist-desktop` — untracks
+*      chat history that an older, unhardened push already committed.
+*      Ignore rules alone cannot untrack an existing path. `--cached`
+*      keeps every file on disk; only the index entry goes away. This
+*      runs even under `ignoreRemovals`, where suppressing deletions
+*      protects remote-only *portal* files — private chats are never
+*      that, and leaving them tracked would keep republishing them.
+*
+* Steps 2 and 3 are best-effort and never fail the publish; the commit
+* itself is what must succeed.
+*
 * Uses the repo's configured identity, else a synthetic Fluid bot
 * identity so the commit isn't rejected. "nothing to commit" is treated
 * as a no-op, not an error.
 */
 async function gitAutoCommit(cwd, message, options = {}) {
+	const repoRoot = await resolveRepoRoot(cwd);
+	excludeLocalStateFromGit(repoRoot);
 	const addArgs = options.ignoreRemovals ? [
 		"add",
 		"--ignore-removal",
@@ -818,15 +1126,27 @@ async function gitAutoCommit(cwd, message, options = {}) {
 	} catch (err) {
 		throw toGitError(err, "add");
 	}
-	let hasName = false;
-	let hasEmail = false;
 	try {
-		hasName = (await execa("git", ["config", "user.name"], { cwd })).stdout.trim().length > 0;
+		await execa("git", [
+			"reset",
+			"-q",
+			"--",
+			":(top).mist",
+			".mist"
+		], { cwd });
 	} catch {}
 	try {
-		hasEmail = (await execa("git", ["config", "user.email"], { cwd })).stdout.trim().length > 0;
+		await execa("git", [
+			"rm",
+			"-q",
+			"-r",
+			"--cached",
+			"--ignore-unmatch",
+			"--",
+			".mist-desktop"
+		], { cwd: repoRoot });
 	} catch {}
-	const identityArgs = [...hasName ? [] : ["-c", "user.name=Fluid Portal CLI"], ...hasEmail ? [] : ["-c", "user.email=portal@fluid.app"]];
+	const identityArgs = await resolveIdentityArgs(cwd);
 	try {
 		await execa("git", [
 			...identityArgs,
@@ -1055,7 +1375,7 @@ async function createPortalProject(appName, options, config, dependencies = defa
 			}).catch(() => {});
 			throw error;
 		}
-	} else await scaffoldFromBundled(targetPath, config, isLocal);
+	} else await scaffoldFromBundled(targetPath, config, isLocal, true);
 	if (config.installDeps) {
 		const installSpinner = ora("Installing dependencies with pnpm...").start();
 		try {
@@ -1105,13 +1425,13 @@ function formatCdPath(targetPath) {
 *
 * Throws on failure; the caller reports and exits.
 */
-async function scaffoldFromBundled(targetPath, config, isLocal) {
+async function scaffoldFromBundled(targetPath, config, isLocal, createTarget) {
 	const templatePaths = getTemplatePaths("starter");
 	if (!await directoryExists(templatePaths.base)) throw new Error("Base template not found");
 	if (!await directoryExists(templatePaths.overlay)) throw new Error("Starter template not found");
 	let sdkVersion;
 	let localCoreVersion;
-	const [cliVersion, portalCliVersion] = await Promise.all([getCliVersion(), getPortalCliVersion()]);
+	const [cliVersion, portalCliVersion] = await Promise.all([getCliVersion().then((version) => resolveInstallableTemplateVersion("@fluid-app/fluid-cli", version)), getPortalCliVersion().then((version) => resolveInstallableTemplateVersion("@fluid-app/fluid-cli-portal", version))]);
 	if (isLocal) {
 		const monorepoRoot = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "..");
 		const sdkPath = join(monorepoRoot, "packages", "portal", "sdk");
@@ -1120,15 +1440,16 @@ async function scaffoldFromBundled(targetPath, config, isLocal) {
 		sdkVersion = getLocalPackageLinkVersion(targetPath, sdkPath);
 		localCoreVersion = getLocalPackageLinkVersion(targetPath, corePath);
 		console.log(chalk.cyan("  Using local packages (--local mode)"));
-	} else sdkVersion = await getSdkVersion();
-	const spinner = ora("Creating project directory...").start();
-	try {
+	} else sdkVersion = await getSdkVersion().then((version) => resolveInstallableTemplateVersion("@fluid-app/portal-sdk", version));
+	const spinner = ora(createTarget ? "Creating project directory..." : "Preparing provisioned portal checkout...").start();
+	if (createTarget) try {
 		await createDirectory(targetPath);
 		spinner.succeed("Created project directory");
 	} catch (error) {
 		spinner.fail("Failed to create project directory");
 		throw error;
 	}
+	else if (!await directoryExists(targetPath)) throw new Error(`Portal checkout does not exist: ${targetPath}`);
 	const templateVariables = {
 		projectName: config.name,
 		sdkVersion,
@@ -1151,6 +1472,79 @@ async function scaffoldFromBundled(targetPath, config, isLocal) {
 		throw error;
 	}
 }
+/**
+* Add the runnable bundled starter to an existing provisioned Git checkout.
+* Portal repositories begin with a bootstrap commit, so a first clone may
+* not contain package.json yet. Rendering into the checkout preserves its
+* .git directory and gives both the CLI and Mist Desktop a usable project
+* without creating unrelated local history.
+*/
+async function scaffoldPortalProjectIntoExistingDirectory(targetPath, config) {
+	const pendingMarker = join(targetPath, PORTAL_SCAFFOLD_PENDING_MARKER);
+	const stagingRoot = await mkdtemp(join(tmpdir(), "fluid-portal-scaffold-stage-"));
+	const stagedProject = join(stagingRoot, "portal");
+	let completed = false;
+	try {
+		await writeFile(pendingMarker, "Fluid Portal scaffold pending\n");
+		await scaffoldFromBundled(stagedProject, config, false, true);
+		const preserved = await copyMissingScaffoldFiles(stagedProject, targetPath);
+		if (preserved.length > 0) console.log(chalk.dim(`  Preserved ${preserved.length} existing repository ${preserved.length === 1 ? "file" : "files"} while adding the runnable scaffold.`));
+		completed = true;
+	} finally {
+		if (completed) await rm(pendingMarker, { force: true });
+		await rm(stagingRoot, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+const PORTAL_SCAFFOLD_PENDING_MARKER = ".fluid-portal-scaffold-pending";
+async function copyMissingScaffoldFiles(sourceRoot, targetRoot, relativeDirectory = "") {
+	const preserved = [];
+	const entries = await readdir(join(sourceRoot, relativeDirectory), { withFileTypes: true });
+	for (const entry of entries) {
+		const relativePath = join(relativeDirectory, entry.name);
+		const sourcePath = join(sourceRoot, relativePath);
+		const targetPath = join(targetRoot, relativePath);
+		if (entry.isDirectory()) {
+			if (!await ensureScaffoldDirectory(targetPath)) throw new Error(`Cannot add the runnable Portal scaffold because the repository path "${relativePath}" is not a directory. The cloned repository and Git history were preserved.`);
+			preserved.push(...await copyMissingScaffoldFiles(sourceRoot, targetRoot, relativePath));
+			continue;
+		}
+		if (!entry.isFile()) throw new Error(`Portal scaffold contains an unsupported file type at ${relativePath}.`);
+		try {
+			await copyFile(sourcePath, targetPath, constants.COPYFILE_EXCL);
+		} catch (error) {
+			if (error.code !== "EEXIST") throw error;
+			preserved.push(relativePath);
+		}
+	}
+	return preserved;
+}
+async function ensureScaffoldDirectory(targetPath) {
+	try {
+		return (await lstat(targetPath)).isDirectory();
+	} catch (error) {
+		const code = error.code;
+		if (code !== "ENOENT") {
+			if (code === "ENOTDIR") return false;
+			throw error;
+		}
+	}
+	try {
+		await mkdir(targetPath);
+		return true;
+	} catch (error) {
+		const code = error.code;
+		if (code !== "EEXIST" && code !== "ENOTDIR") throw error;
+		try {
+			return (await lstat(targetPath)).isDirectory();
+		} catch (statError) {
+			if (statError.code === "ENOTDIR") return false;
+			throw statError;
+		}
+	}
+}
 //#endregion
 //#region src/commands/dev.ts
 /**
@@ -1164,6 +1558,46 @@ async function scaffoldFromBundled(targetPath, config, isLocal) {
 * or auto-pulls if they are logged in.
 */
 const PORTAL_DIR$1 = "portal";
+const WATCHED_DIRECTORIES = [
+	"portal",
+	"public",
+	"src"
+];
+const WATCHED_ROOT_FILES = new Set([
+	"index.html",
+	"package.json",
+	"tsconfig.json",
+	"vite.config.cjs",
+	"vite.config.cts",
+	"vite.config.js",
+	"vite.config.mjs",
+	"vite.config.mts",
+	"vite.config.ts"
+]);
+/**
+* Restrict Vite's root watcher to files that can affect a portal preview.
+* Directory paths themselves must remain visible to Chokidar so it can
+* descend into them and discover their files.
+*/
+function createPortalWatchIgnored(cwd) {
+	const projectRoot = resolve(cwd);
+	return (filePath) => {
+		const projectPath = relative(projectRoot, isAbsolute(filePath) ? filePath : resolve(projectRoot, filePath));
+		if (projectPath === "") return false;
+		if (projectPath === ".." || projectPath.startsWith(`..${sep}`)) return true;
+		const [topLevelPath] = projectPath.split(sep);
+		if (WATCHED_DIRECTORIES.some((directory) => topLevelPath === directory)) return false;
+		const isEnvironmentFile = projectPath === ".env" || projectPath.startsWith(".env.");
+		return !WATCHED_ROOT_FILES.has(projectPath) && !isEnvironmentFile;
+	};
+}
+function portalDevServerOptions(port, exposeToNetwork, cwd = process.cwd()) {
+	return {
+		port,
+		host: exposeToNetwork ? true : void 0,
+		watch: { ignored: createPortalWatchIgnored(cwd) }
+	};
+}
 /**
 * Check if the portal directory exists and has content files.
 * Returns true if at minimum `portal/definition.json` exists.
@@ -1191,7 +1625,7 @@ function checkDependenciesInstalled(cwd) {
 	if (existsSync(nodeModulesPath) && hasVite && hasPortalSdk) return { ok: true };
 	return {
 		ok: false,
-		message: `Dependencies aren't installed in ${cwd} — run \`pnpm install\` (or reopen the project in Mist Desktop, which installs automatically), then retry.`
+		message: `Dependencies aren't installed in ${cwd} — run \`pnpm install\`, then retry.`
 	};
 }
 /**
@@ -1203,7 +1637,7 @@ async function autoPull(cwd) {
 	console.log(chalk.yellow("No portal/ directory found.") + " Attempting to pull content...");
 	console.log();
 	try {
-		const { pullCommand } = await import("./pull-XOsFaqz2.mjs").then((n) => n.n);
+		const { pullCommand } = await import("./pull-C3yj9L07.mjs").then((n) => n.n);
 		await pullCommand.parseAsync([], { from: "user" });
 		return hasPortalContent(cwd);
 	} catch (err) {
@@ -1256,16 +1690,13 @@ const devCommand = new Command("dev").description("Start the development server
 	const port = Number.isFinite(parsedPort) ? parsedPort : 5173;
 	try {
 		const { createServer } = await import("vite");
-		const { portalDevPlugin } = await import("./portal-dev-plugin-BHE8Z4yr.mjs").then((n) => n.n);
+		const { portalDevPlugin } = await import("./portal-dev-plugin-ByYelgFg.mjs").then((n) => n.n);
 		const { backendDevPlugin } = await import("./backend-dev-plugin-B9-S4Is-.mjs").then((n) => n.n);
 		const server = await createServer({
 			configFile: viteConfigPath,
 			envPrefix: ["VITE_", "NEXT_PUBLIC_"],
 			plugins: [portalDevPlugin(), backendDevPlugin()],
-			server: {
-				port,
-				host: options.host ? true : void 0
-			}
+			server: portalDevServerOptions(port, options.host === true, cwd)
 		});
 		await server.listen();
 		server.printUrls();
@@ -1401,6 +1832,8 @@ function categorizeChanges(diff) {
 * Validate that all cross-references between local portal files are valid.
 *
 * Checks:
+* - New and changed resources contain the required local-file fields
+* - New and changed themes include the required config object
 * - Navigation items' "screen" slugs reference existing screen files or mappings
 * - Profile "navigation" and "mobile_navigation" slugs reference existing nav files or mappings
 * - Profile "themes" slugs reference existing theme files or mappings
@@ -1413,9 +1846,43 @@ async function validateCrossReferences(portalDir, mappings, changes) {
 	for (const file of changes.screens.deleted) validScreenSlugs.delete(slugFromPath(file));
 	for (const file of changes.navigations.deleted) validNavSlugs.delete(slugFromPath(file));
 	for (const file of changes.themes.deleted) validThemeSlugs.delete(slugFromPath(file));
+	const screenFilesToCheck = [...changes.screens.new, ...changes.screens.changed];
+	for (const file of screenFilesToCheck) try {
+		const screen = await readPortalFile$1(portalDir, file);
+		if (typeof screen.name !== "string" || !Array.isArray(screen.component_tree)) errors.push({
+			file,
+			message: "Screen requires a string \"name\" and array \"component_tree\"."
+		});
+	} catch {
+		errors.push({
+			file,
+			message: "Failed to read screen file"
+		});
+	}
+	const themeFilesToCheck = [...changes.themes.new, ...changes.themes.changed];
+	for (const file of themeFilesToCheck) try {
+		const theme = await readPortalFile$1(portalDir, file);
+		if (typeof theme.name !== "string" || typeof theme.active !== "boolean" || !theme.config || typeof theme.config !== "object" || Array.isArray(theme.config)) errors.push({
+			file,
+			message: "Theme requires a string \"name\", boolean \"active\", and \"config\" object. Copy the complete config shape from a pulled theme instead of creating only name/active fields."
+		});
+	} catch {
+		errors.push({
+			file,
+			message: "Failed to read theme file"
+		});
+	}
 	const navFilesToCheck = [...changes.navigations.new, ...changes.navigations.changed];
 	for (const file of navFilesToCheck) try {
-		validateNavigationItems((await readPortalFile$1(portalDir, file)).navigation_items, file, validScreenSlugs, errors);
+		const nav = await readPortalFile$1(portalDir, file);
+		if (typeof nav.name !== "string" || nav.platform !== "web" && nav.platform !== "mobile" || !Array.isArray(nav.navigation_items)) {
+			errors.push({
+				file,
+				message: "Navigation requires a string \"name\", \"platform\" set to \"web\" or \"mobile\", and a \"navigation_items\" array."
+			});
+			continue;
+		}
+		validateNavigationItems(nav.navigation_items, file, validScreenSlugs, errors);
 	} catch {
 		errors.push({
 			file,
@@ -1425,6 +1892,14 @@ async function validateCrossReferences(portalDir, mappings, changes) {
 	const profileFilesToCheck = [...changes.profiles.new, ...changes.profiles.changed];
 	for (const file of profileFilesToCheck) try {
 		const profile = await readPortalFile$1(portalDir, file);
+		const permissions = profile.permissions;
+		if (typeof profile.name !== "string" || typeof profile.default !== "boolean" || !Array.isArray(profile.themes) || !permissions || !Array.isArray(permissions.countries) || !Array.isArray(permissions.ranks) || !Array.isArray(permissions.roles) || !Array.isArray(permissions.platform)) {
+			errors.push({
+				file,
+				message: "Profile requires \"name\", boolean \"default\", a \"themes\" array, and permissions arrays for countries, ranks, roles, and platform."
+			});
+			continue;
+		}
 		if (profile.navigation && !validNavSlugs.has(profile.navigation)) errors.push({
 			file,
 			message: `References navigation "${profile.navigation}" which does not exist`
@@ -1483,15 +1958,71 @@ function validateNavigationItems(items, file, validScreenSlugs, errors) {
 function portalGitCredentialPath(definitionId) {
 	return `/api/company/fluid_os/definitions/${definitionId}/git_credential`;
 }
-function extractErrorReason(body, fallback) {
-	if (body && typeof body === "object" && "error" in body) {
-		const error = body.error;
-		if (error && typeof error === "object" && "message" in error) {
-			const message = error.message;
-			if (typeof message === "string" && message.length > 0) return message;
-		}
+const DEFAULT_RETRY_DELAYS_MS = [
+	500,
+	1e3,
+	2e3,
+	4e3,
+	8e3,
+	1e4,
+	15e3,
+	15e3
+];
+const DEFAULT_REQUEST_TIMEOUT_MS = 15e3;
+const RETRYABLE_CONFLICT_TYPES = new Set(["not_provisioned"]);
+function nonEmptyString(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function firstString(value) {
+	if (Array.isArray(value)) return nonEmptyString(value[0]);
+	return nonEmptyString(value);
+}
+function extractErrorDetails(body, fallback) {
+	if (!body || typeof body !== "object") return { reason: fallback };
+	const envelope = body;
+	const error = envelope.error && typeof envelope.error === "object" ? envelope.error : void 0;
+	const nestedDetails = error?.details && typeof error.details === "object" ? error.details : void 0;
+	const errors = envelope.errors && typeof envelope.errors === "object" ? envelope.errors : void 0;
+	const reason = nonEmptyString(envelope.error_message) ?? nonEmptyString(error?.message) ?? nonEmptyString(envelope.error) ?? fallback;
+	const failureType = firstString(errors?.type) ?? nonEmptyString(nestedDetails?.type);
+	return {
+		reason,
+		...failureType ? { failureType } : {}
+	};
+}
+function sleep(delayMs) {
+	return new Promise((resolve) => {
+		setTimeout(resolve, delayMs);
+	});
+}
+/**
+* Retry clone-credential conflicts while the backend provisions or revives
+* the portal's repository. The first credential request is the trigger for
+* older definitions with no repo, so a single-shot clone would always fail
+* even though the repository becomes ready seconds later.
+*/
+async function createPortalGitCredentialWithRetry(options) {
+	const retryDelaysMs = options.retryDelaysMs ?? DEFAULT_RETRY_DELAYS_MS;
+	const sleepImpl = options.sleepImpl ?? sleep;
+	const requestOptions = {
+		baseUrl: options.baseUrl,
+		token: options.token,
+		definitionId: options.definitionId,
+		...options.fetchImpl !== void 0 ? { fetchImpl: options.fetchImpl } : {},
+		...options.requestTimeoutMs !== void 0 ? { requestTimeoutMs: options.requestTimeoutMs } : {}
+	};
+	let outcome = await createPortalGitCredential(requestOptions);
+	for (const [index, delayMs] of retryDelaysMs.entries()) {
+		if (outcome.status !== "unavailable" || !outcome.retryable) return outcome;
+		options.onRetry?.({
+			attempt: index + 2,
+			totalAttempts: retryDelaysMs.length + 1,
+			reason: outcome.reason
+		});
+		await sleepImpl(delayMs);
+		outcome = await createPortalGitCredential(requestOptions);
 	}
-	return fallback;
+	return outcome;
 }
 /**
 * Request a git credential for the portal definition's provisioned repo.
@@ -1502,36 +2033,54 @@ function extractErrorReason(body, fallback) {
 async function createPortalGitCredential(options) {
 	const { baseUrl, token, definitionId } = options;
 	const fetchImpl = options.fetchImpl ?? fetch;
+	const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
 	const url = `${baseUrl.replace(/\/$/, "")}${portalGitCredentialPath(definitionId)}`;
+	const abortController = new AbortController();
+	let requestTimedOut = false;
+	const timeout = setTimeout(() => {
+		requestTimedOut = true;
+		abortController.abort();
+	}, requestTimeoutMs);
 	let resp;
+	let body = null;
 	try {
 		resp = await fetchImpl(url, {
 			method: "POST",
 			headers: {
 				Authorization: `Bearer ${token}`,
 				Accept: "application/json"
-			}
+			},
+			signal: abortController.signal
 		});
+		if (resp.status !== 404) try {
+			body = await resp.json();
+		} catch (err) {
+			if (requestTimedOut) throw err;
+		}
 	} catch (err) {
 		return {
 			status: "error",
-			reason: err instanceof Error ? err.message : String(err)
+			reason: requestTimedOut ? `git credential request timed out after ${requestTimeoutMs}ms` : err instanceof Error ? err.message : String(err)
 		};
+	} finally {
+		clearTimeout(timeout);
 	}
 	if (resp.status === 404) return {
 		status: "unavailable",
-		reason: "git sync isn't available for portals on this Fluid API yet"
+		reason: "git sync isn't available for portals on this Fluid API yet",
+		retryable: false
 	};
-	const body = await resp.json().catch(() => null);
 	if (!resp.ok) {
-		const reason = extractErrorReason(body, `git credential request failed (HTTP ${resp.status})`);
+		const details = extractErrorDetails(body, `git credential request failed (HTTP ${resp.status})`);
 		if (resp.status === 409) return {
 			status: "unavailable",
-			reason
+			reason: details.reason,
+			retryable: details.failureType !== void 0 && RETRYABLE_CONFLICT_TYPES.has(details.failureType),
+			...details.failureType !== void 0 ? { conflictType: details.failureType } : {}
 		};
 		return {
 			status: "error",
-			reason
+			reason: details.reason
 		};
 	}
 	const credential = body?.git_credential;
@@ -1556,6 +2105,9 @@ async function createPortalGitCredential(options) {
 * (no git, no repo, credential endpoint missing, diverged history,
 * network blip) degrades to a skip so the content push always proceeds.
 */
+/** Subject for the index-only commit that untracks leaked Desktop state.
+*  Kept distinct from the publish message so the history explains itself. */
+const PURGE_COMMIT_MESSAGE = "Remove private Mist Desktop state from the portal repository";
 /**
 * Run the best-effort git sync. Returns a result describing what
 * happened; never throws. Callers surface `skipped` reasons as a dim
@@ -1568,6 +2120,7 @@ async function runPortalGitSync(options) {
 		status: "skipped",
 		reason: "not a git repository"
 	};
+	await ensureLocalStateExcluded(cwd);
 	const outcome = await createPortalGitCredential({
 		baseUrl,
 		token,
@@ -1594,6 +2147,7 @@ async function runPortalGitSync(options) {
 				await gitFetch(cwd, remoteUrl, branch);
 				await gitAdoptFetchHead(cwd);
 			}
+			await purgeLocalStateFromIndex(cwd, PURGE_COMMIT_MESSAGE);
 			if (await hasUncommittedChanges(cwd)) await gitAutoCommit(cwd, commitMessage, { ignoreRemovals: true });
 			return await pushCommitted(cwd, remoteUrl, branch);
 		}
@@ -1614,6 +2168,7 @@ async function runPortalGitSync(options) {
 			};
 			await gitMergeFastForward(cwd);
 		}
+		await purgeLocalStateFromIndex(cwd, PURGE_COMMIT_MESSAGE);
 		if (await hasUncommittedChanges(cwd)) await gitAutoCommit(cwd, commitMessage);
 		return await pushCommitted(cwd, remoteUrl, branch);
 	} catch (err) {
@@ -1655,6 +2210,9 @@ async function pushCommitted(cwd, remoteUrl, branch) {
 * Detects changes since the last pull/push via snapshot diffing,
 * validates cross-references, and pushes resources in dependency order.
 */
+var NavigationRemoteStateUnknownError = class extends Error {
+	name = "NavigationRemoteStateUnknownError";
+};
 const PORTAL_DIR = "portal";
 const PORTAL_SYNC_DIR$1 = ".portal-sync";
 /**
@@ -1682,6 +2240,28 @@ function createClient$2() {
 		getAuthToken: () => token
 	});
 }
+async function createAndActivateVersion(client, definitionId) {
+	const versionId = (await fluid_os_v0_create_fluid_osversion(client, definitionId)).version?.id;
+	if (!versionId) throw new Error("the version API returned no version ID");
+	await fluid_os_v0_update_fluid_osversion(client, definitionId, versionId, { version: { active: true } });
+	return String(versionId);
+}
+async function activateDraft(definitionId, existingClient) {
+	const spinner = ora("Creating and activating a live version...");
+	spinner.start();
+	try {
+		const versionId = await createAndActivateVersion(existingClient ?? createClient$2(), definitionId);
+		spinner.succeed(`Live version ${versionId} activated`);
+		return true;
+	} catch (err) {
+		spinner.fail("Could not activate a live version");
+		console.log();
+		console.log(chalk.red("Error:") + " " + (err instanceof Error ? err.message : String(err)));
+		console.log();
+		process.exitCode = 1;
+		return false;
+	}
+}
 /**
 * Extract an enriched error message from a caught value.
 * Includes structured API error data when available.
@@ -1691,6 +2271,18 @@ function enrichedErrorMessage(err) {
 	if (err && typeof err === "object" && "data" in err) msg += ` — ${JSON.stringify(err.data)}`;
 	return msg;
 }
+function navigationPushFailure(err, remoteChangesComplete) {
+	const error = enrichedErrorMessage(err);
+	if (err instanceof NavigationRemoteStateUnknownError) return {
+		advanceSnapshot: true,
+		error
+	};
+	if (!remoteChangesComplete) return { error };
+	return {
+		advanceSnapshot: true,
+		error: `Remote changes were applied before the push failed: ${error}. Run fluid portal pull before editing or pushing again.`
+	};
+}
 /**
 * Best-effort "invisible git" sync: commit the local project and push it
 * to the portal's provisioned GitHub repo before the content push.
@@ -1985,25 +2577,129 @@ function resolveNavigationItemScreenIds(items, mappings) {
 * The API reconciliation logic requires a flat list to correctly
 * compare against the flat server response.
 */
-function flattenNavigationItems(items) {
-	const flat = [];
+function flattenNavigationItems(items, treeParentIndex, flat = []) {
 	for (const item of items) {
 		const { children, ...rest } = item;
-		flat.push(rest);
-		if (children && children.length > 0) flat.push(...flattenNavigationItems(children));
+		const itemIndex = flat.length;
+		flat.push({
+			...rest,
+			treeParentIndex
+		});
+		if (children && children.length > 0) flattenNavigationItems(children, itemIndex, flat);
+	}
+	return flat;
+}
+/**
+* The navigation-items index returns root items with descendants nested under
+* `children`. Flatten descendants first so removals cannot orphan or revisit a
+* child when its parent is also deleted.
+*/
+function flattenServerNavigationItems(items, flat = []) {
+	for (const item of items) {
+		flattenServerNavigationItems(item.children ?? [], flat);
+		flat.push(item);
 	}
 	return flat;
 }
+function resolveNavigationItemParentId(item, serverIdByItemIndex) {
+	if (item.treeParentIndex != null) {
+		const serverParentId = serverIdByItemIndex.get(item.treeParentIndex);
+		if (serverParentId == null) throw new Error("Failed to resolve the server ID for a nested navigation item's parent");
+		return serverParentId;
+	}
+	return null;
+}
+async function resolveCreatedNavigationItemId(client, defId, navigationId, responseId, knownServerIds, requestedItem, file) {
+	if (responseId != null) {
+		knownServerIds.add(responseId);
+		return responseId;
+	}
+	let response;
+	try {
+		response = await fluid_os_v0_list_fluid_osnavigation_items(client, defId, navigationId);
+	} catch (recoveryError) {
+		throw new NavigationRemoteStateUnknownError(`Remote navigation state is unknown because item creation succeeded without returning its required ID, and the recovery read failed: ${enrichedErrorMessage(recoveryError)}. Back up ${file}, run fluid portal pull, then reapply pending edits before pushing again.`);
+	}
+	const unseenItems = flattenServerNavigationItems(response.navigation_items ?? []).filter((item) => !knownServerIds.has(item.id));
+	const matchingItems = unseenItems.filter((item) => (item.label ?? "") === requestedItem.label && (item.position ?? 0) === requestedItem.position && (item.icon ?? void 0) === requestedItem.icon && (item.screen_id ?? void 0) === requestedItem.screen_id && (item.slug ?? void 0) === requestedItem.slug && (item.source ?? "user") === (requestedItem.source ?? "user") && (item.parent_id ?? null) === (requestedItem.parent_id ?? null));
+	if (unseenItems.length !== 1 || matchingItems.length !== 1) throw new NavigationRemoteStateUnknownError(`Remote navigation state is unknown because item creation succeeded without returning its required ID, and recovery found ${matchingItems.length} matching items among ${unseenItems.length} new server items. Back up ${file}, run fluid portal pull, then reapply pending edits before pushing again.`);
+	const recoveredId = matchingItems[0]?.id;
+	if (recoveredId == null) throw new NavigationRemoteStateUnknownError(`Remote navigation state is unknown because item creation succeeded without returning its required ID. Back up ${file}, run fluid portal pull, then reapply pending edits before pushing again.`);
+	knownServerIds.add(recoveredId);
+	return recoveredId;
+}
+function assignNavigationItemId(navigation, targetIndex, serverId) {
+	let currentIndex = 0;
+	let previousId;
+	function assign(items) {
+		return items.map((item) => {
+			const itemIndex = currentIndex++;
+			const children = assign(item.children ?? []);
+			if (itemIndex !== targetIndex) return {
+				...item,
+				children
+			};
+			previousId = item.id;
+			return {
+				...item,
+				id: serverId,
+				children
+			};
+		});
+	}
+	function rewriteParentIds(items) {
+		return items.map((item) => ({
+			...item,
+			parent_id: item.parent_id === previousId ? serverId : item.parent_id,
+			children: rewriteParentIds(item.children ?? [])
+		}));
+	}
+	const navigationItems = assign(navigation.navigation_items);
+	return {
+		...navigation,
+		navigation_items: previousId == null || previousId === serverId ? navigationItems : rewriteParentIds(navigationItems)
+	};
+}
+async function persistCreatedNavigationItemId(client, defId, navigationId, portalDir, file, navigation, itemIndex, serverId) {
+	const updated = assignNavigationItemId(navigation, itemIndex, serverId);
+	try {
+		await atomicWriteFile(join(portalDir, file), JSON.stringify(updated, null, 2) + "\n");
+	} catch (persistError) {
+		try {
+			await fluid_os_v0_delete_fluid_osnavigation_item(client, defId, navigationId, serverId);
+		} catch (rollbackError) {
+			throw new NavigationRemoteStateUnknownError(`Failed to persist navigation item ${serverId} locally: ${enrichedErrorMessage(persistError)}. Automatic rollback also failed: ${enrichedErrorMessage(rollbackError)}. Back up ${file}, run fluid portal pull, then reapply pending edits before pushing again.`);
+		}
+		throw persistError;
+	}
+	return updated;
+}
+/**
+* Replace a pushed navigation file with the authoritative server tree.
+* New navigation items receive their IDs from the server, so the local file
+* must be reconciled before the push snapshot hashes it.
+*/
+async function reconcileNavigationFile(client, defId, navId, portalDir, file, local, mappings) {
+	const response = await fluid_os_v0_list_fluid_osnavigation_items(client, defId, navId);
+	const reconciled = {
+		...local,
+		navigation_items: transformNavigationItems(response.navigation_items ?? [], buildIdToSlugMap(mappings.screens))
+	};
+	await atomicWriteFile(join(portalDir, file), JSON.stringify(reconciled, null, 2) + "\n");
+}
 /**
 * Push navigation changes to the API.
 */
 async function pushNavigations(client, defId, portalDir, changes, mappings) {
 	const results = [];
 	let currentMappings = mappings;
-	for (const file of changes.new) {
+	const newFiles = changes.new.filter((file) => resolveSlugToId(currentMappings, "navigations", slugFromPath(file)) == null);
+	const changedFiles = [...changes.changed, ...changes.new.filter((file) => resolveSlugToId(currentMappings, "navigations", slugFromPath(file)) != null)];
+	for (const file of newFiles) {
 		const slug = slugFromPath(file);
+		let remoteChangesComplete = false;
 		try {
-			const local = await readPortalFile(portalDir, file);
+			let local = await readPortalFile(portalDir, file);
 			const newId = (await fluid_os_v0_create_fluid_osnavigation(client, defId, { navigation: {
 				name: local.name,
 				platform: local.platform
@@ -2011,10 +2707,11 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 			if (newId != null) {
 				currentMappings = updateMapping(currentMappings, "navigations", slug, newId);
 				const resolvedItems = flattenNavigationItems(resolveNavigationItemScreenIds(local.navigation_items, currentMappings));
-				const localToServerId = /* @__PURE__ */ new Map();
-				for (const item of resolvedItems) {
-					const resolvedParentId = item.parent_id != null ? localToServerId.get(item.parent_id) ?? item.parent_id : void 0;
-					const created = await fluid_os_v0_create_fluid_osnavigation_item(client, defId, newId, { navigation_item: {
+				const serverIdByItemIndex = /* @__PURE__ */ new Map();
+				const knownServerIds = /* @__PURE__ */ new Set();
+				for (const [itemIndex, item] of resolvedItems.entries()) {
+					const resolvedParentId = resolveNavigationItemParentId(item, serverIdByItemIndex);
+					const createBody = {
 						label: item.label ?? "",
 						position: item.position ?? 0,
 						icon: item.icon ?? void 0,
@@ -2022,9 +2719,13 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 						slug: item.slug ?? void 0,
 						source: item.source ?? void 0,
 						parent_id: resolvedParentId
-					} });
-					if (item.id != null && created.navigation_item?.id != null) localToServerId.set(item.id, created.navigation_item.id);
+					};
+					const createdId = await resolveCreatedNavigationItemId(client, defId, newId, (await fluid_os_v0_create_fluid_osnavigation_item(client, defId, newId, { navigation_item: createBody })).navigation_item?.id, knownServerIds, createBody, file);
+					local = await persistCreatedNavigationItemId(client, defId, newId, portalDir, file, local, itemIndex, createdId);
+					serverIdByItemIndex.set(itemIndex, createdId);
 				}
+				remoteChangesComplete = true;
+				await reconcileNavigationFile(client, defId, newId, portalDir, file, local, currentMappings);
 			}
 			results.push({
 				file,
@@ -2036,7 +2737,7 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 				file,
 				action: "created",
 				success: false,
-				error: enrichedErrorMessage(err)
+				...navigationPushFailure(err, remoteChangesComplete)
 			});
 			return {
 				results,
@@ -2044,7 +2745,7 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 			};
 		}
 	}
-	for (const file of changes.changed) {
+	for (const file of changedFiles) {
 		const slug = slugFromPath(file);
 		const navId = resolveSlugToId(currentMappings, "navigations", slug);
 		if (navId == null) {
@@ -2059,20 +2760,21 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 				mappings: currentMappings
 			};
 		}
+		let remoteChangesComplete = false;
 		try {
-			const local = await readPortalFile(portalDir, file);
+			let local = await readPortalFile(portalDir, file);
 			await fluid_os_v0_update_fluid_osnavigation(client, defId, navId, { navigation: {
 				name: local.name,
 				platform: local.platform
 			} });
 			const resolvedItems = flattenNavigationItems(resolveNavigationItemScreenIds(local.navigation_items, currentMappings));
-			const serverItems = (await fluid_os_v0_list_fluid_osnavigation_items(client, defId, navId)).navigation_items ?? [];
+			const serverItems = flattenServerNavigationItems((await fluid_os_v0_list_fluid_osnavigation_items(client, defId, navId)).navigation_items ?? []);
 			const serverById = new Map(serverItems.map((s) => [s.id, s]));
+			const knownServerIds = new Set(serverById.keys());
 			const localIds = new Set(resolvedItems.filter((i) => i.id).map((i) => i.id));
-			for (const serverItem of serverItems) if (!localIds.has(serverItem.id)) await fluid_os_v0_delete_fluid_osnavigation_item(client, defId, navId, serverItem.id);
-			const localToServerId = /* @__PURE__ */ new Map();
-			for (const item of resolvedItems) {
-				const resolvedParentId = item.parent_id != null ? localToServerId.get(item.parent_id) ?? item.parent_id : void 0;
+			const serverIdByItemIndex = /* @__PURE__ */ new Map();
+			for (const [itemIndex, item] of resolvedItems.entries()) {
+				const resolvedParentId = resolveNavigationItemParentId(item, serverIdByItemIndex);
 				const body = {
 					label: item.label,
 					position: item.position,
@@ -2082,16 +2784,23 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 					source: item.source ?? void 0,
 					parent_id: resolvedParentId
 				};
-				if (item.id && serverById.has(item.id)) await fluid_os_v0_update_fluid_osnavigation_item(client, defId, navId, item.id, { navigation_item: body });
-				else {
-					const created = await fluid_os_v0_create_fluid_osnavigation_item(client, defId, navId, { navigation_item: {
+				if (item.id && serverById.has(item.id)) {
+					await fluid_os_v0_update_fluid_osnavigation_item(client, defId, navId, item.id, { navigation_item: body });
+					serverIdByItemIndex.set(itemIndex, item.id);
+				} else {
+					const createBody = {
 						...body,
 						label: body.label ?? "",
 						position: body.position ?? 0
-					} });
-					if (item.id != null && created.navigation_item?.id != null) localToServerId.set(item.id, created.navigation_item.id);
+					};
+					const createdId = await resolveCreatedNavigationItemId(client, defId, navId, (await fluid_os_v0_create_fluid_osnavigation_item(client, defId, navId, { navigation_item: createBody })).navigation_item?.id, knownServerIds, createBody, file);
+					local = await persistCreatedNavigationItemId(client, defId, navId, portalDir, file, local, itemIndex, createdId);
+					serverIdByItemIndex.set(itemIndex, createdId);
 				}
 			}
+			for (const serverItem of serverItems) if (!localIds.has(serverItem.id)) await fluid_os_v0_delete_fluid_osnavigation_item(client, defId, navId, serverItem.id);
+			remoteChangesComplete = true;
+			await reconcileNavigationFile(client, defId, navId, portalDir, file, local, currentMappings);
 			results.push({
 				file,
 				action: "updated",
@@ -2102,7 +2811,7 @@ async function pushNavigations(client, defId, portalDir, changes, mappings) {
 				file,
 				action: "updated",
 				success: false,
-				error: enrichedErrorMessage(err)
+				...navigationPushFailure(err, remoteChangesComplete)
 			});
 			return {
 				results,
@@ -2302,7 +3011,7 @@ function printPushReport(results, skippedPhases) {
 		for (const phase of skippedPhases) console.log(chalk.yellow("  " + phase));
 	}
 }
-const pushCommand = new Command("push").description("Push local portal content changes to the Fluid OS API").option("--yes", "Skip confirmation prompt").action(async (options) => {
+const pushCommand = new Command("push").description("Push local portal content changes to the Fluid OS API").option("--yes", "Skip confirmation prompt").option("--activate", "Create and activate a live version after a successful push").action(async (options) => {
 	const cwd = process.cwd();
 	const portalDir = join(cwd, PORTAL_DIR);
 	const portalSyncDir = join(cwd, PORTAL_SYNC_DIR$1);
@@ -2341,6 +3050,10 @@ const pushCommand = new Command("push").description("Push local portal content c
 	if (totalChanges === 0) {
 		spinner.succeed("Nothing to push.");
 		console.log();
+		if (options.activate) {
+			await activateDraft(definitionId);
+			console.log();
+		}
 		return;
 	}
 	spinner.succeed(`Found ${totalChanges} change(s)`);
@@ -2362,16 +3075,16 @@ const pushCommand = new Command("push").description("Push local portal content c
 		console.log();
 	}
 	const changes = categorizeChanges(diff);
-	spinner.start("Validating cross-references...");
+	spinner.start("Validating portal files...");
 	const validationErrors = await validateCrossReferences(portalDir, mappings, changes);
 	if (validationErrors.length > 0) {
-		spinner.fail("Cross-reference validation failed");
+		spinner.fail("Portal file validation failed");
 		console.log();
 		for (const err of validationErrors) console.log(chalk.red("  " + err.file + ": ") + err.message);
 		console.log();
 		process.exit(1);
 	}
-	spinner.succeed("Cross-references valid");
+	spinner.succeed("Portal files valid");
 	spinner.start("Authenticating...");
 	let client;
 	try {
@@ -2442,10 +3155,10 @@ const pushCommand = new Command("push").description("Push local portal content c
 		else spinner.succeed("Phase 3 complete");
 	}
 	await writeMappings(portalSyncDir, currentMappings);
-	const successfulFiles = new Set(allResults.filter((r) => r.success).map((r) => r.file));
-	if (successfulFiles.size > 0) {
+	const filesToSnapshot = new Set(allResults.filter((r) => r.success || r.advanceSnapshot).map((r) => r.file));
+	if (filesToSnapshot.size > 0) {
 		const updatedHashes = { ...snapshot.files };
-		for (const file of successfulFiles) {
+		for (const file of filesToSnapshot) {
 			const fullPath = join(portalDir, file);
 			if (existsSync(fullPath)) updatedHashes[file] = await computeFileHash(fullPath);
 			else delete updatedHashes[file];
@@ -2456,11 +3169,20 @@ const pushCommand = new Command("push").description("Push local portal content c
 		});
 	}
 	console.log();
-	if (allResults.every((r) => r.success) && !aborted) console.log(chalk.green.bold("Push complete!"));
+	const allSucceeded = allResults.every((r) => r.success);
+	if (allSucceeded && !aborted) console.log(chalk.green.bold("Push complete!"));
 	else console.log(chalk.yellow.bold("Push completed with issues:"));
 	console.log();
 	printPushReport(allResults, skippedPhases);
 	console.log();
+	if (!allSucceeded || aborted) {
+		process.exitCode = 1;
+		return;
+	}
+	if (options.activate) {
+		await activateDraft(definitionId, client);
+		console.log();
+	}
 });
 //#endregion
 //#region src/commands/clone.ts
@@ -2470,23 +3192,87 @@ const pushCommand = new Command("push").description("Push local portal content c
 * `./<slug>/`. Mirrors `fluid mist clone` (credential → clone), but
 * against the portal git-credential endpoint.
 *
-* The credential endpoint is part of GitSync phase 006; until it ships
-* the request 404s and we print a friendly "not available yet" message
-* instead of a raw git error.
+* When the credential endpoint reports that no repository is available
+* (the company's Git integration isn't connected, the repo is still
+* unprovisioned after the retry budget, or the endpoint isn't deployed),
+* clone falls back to scaffolding the portal locally from the bundled
+* starter template instead of failing. Local files plus API sync
+* (`fluid portal push`/`pull`) are a fully functional portal — Git is
+* an optional sync channel, not a prerequisite — so the user still
+* lands in a working project and Git history can attach later.
 */
 function getBaseUrl() {
 	return process.env["FLUID_API_BASE"] ?? "https://api.fluid.app";
 }
+async function removeIncompleteCheckout(targetDir) {
+	try {
+		await rm(targetDir, {
+			recursive: true,
+			force: true
+		});
+		return null;
+	} catch (error) {
+		return error instanceof Error ? error.message : String(error);
+	}
+}
 function createClient$1(token) {
 	return createFetchClient({
 		baseUrl: getBaseUrl(),
 		getAuthToken: () => token
 	});
 }
-/** Select a definition by --app name, else interactively. */
-async function selectDefinition(client, appName) {
-	const definitions = [];
-	let page = 1;
+/**
+* Human message for the git-sync-unavailable fallback, split by conflict
+* type. `not_connected` is a durable state (the company's Git integration
+* isn't connected), so it must not claim that waiting will fix anything;
+* `not_provisioned` genuinely may resolve later, so it says so.
+*/
+function gitSyncUnavailableNotice(outcome) {
+	if (outcome.conflictType === "not_connected") return `This company's Git integration isn't connected, so the portal has no Git repository to clone. Creating the portal locally from the starter template instead — ${chalk.cyan("fluid portal push")}/${chalk.cyan("pull")} sync content without Git, and Git sync can attach once the integration is connected.`;
+	if (outcome.conflictType === "not_provisioned") return "The portal's Git repository isn't provisioned yet. Creating the portal locally from the starter template so you can start now — Git sync can attach once the repository is ready.";
+	return `Git sync isn't available (${outcome.reason}). Creating the portal locally from the starter template instead.`;
+}
+/**
+* A git-less fallback scaffold that failed or was interrupted leaves the
+* pending marker behind with no `.git`. Only that exact shape is safe to
+* resume — anything else is an unrelated pre-existing directory.
+*/
+async function canResumeGitlessPortalScaffold(targetDir) {
+	return await fileExists(join(targetDir, ".fluid-portal-scaffold-pending")) && !existsSync(join(targetDir, ".git"));
+}
+async function canResumePortalScaffold(targetDir, credentialRemoteUrl) {
+	if (!await fileExists(join(targetDir, ".fluid-portal-scaffold-pending")) || !await isGitRepo(targetDir)) return false;
+	const origin = await getOriginUrl(targetDir);
+	if (!origin) return false;
+	const expected = cleanGitRemoteUrl(credentialRemoteUrl);
+	return origin.replace(/\/$/, "") === expected.replace(/\/$/, "");
+}
+function resolveDefinition(definitions, appName, rawDefinitionId) {
+	if (rawDefinitionId !== void 0) {
+		if (!/^[1-9]\d*$/.test(rawDefinitionId)) throw new Error("--id must be a positive integer");
+		const definitionId = Number.parseInt(rawDefinitionId, 10);
+		const match = definitions.find((definition) => definition.id === definitionId);
+		if (!match) throw new Error(`No definition found with id ${definitionId}.`);
+		return {
+			id: definitionId,
+			name: match.name ?? `portal-${definitionId}`
+		};
+	}
+	if (!appName) return null;
+	const match = definitions.find((definition) => definition.name?.toLowerCase() === appName.toLowerCase());
+	if (!match || match.id == null) {
+		const available = definitions.map((definition) => chalk.cyan(definition.name ?? "(unnamed)")).join(", ");
+		throw new Error(`No definition found matching "${appName}". Available: ${available}`);
+	}
+	return {
+		id: match.id,
+		name: match.name ?? `portal-${match.id}`
+	};
+}
+/** Select a definition by --app name, else interactively. */
+async function selectDefinition(client, appName, rawDefinitionId) {
+	const definitions = [];
+	let page = 1;
 	while (true) {
 		const response = await fluid_os_v0_list_fluid_osdefinitions(client, {
 			page,
@@ -2499,17 +3285,8 @@ async function selectDefinition(client, appName) {
 		page++;
 	}
 	if (definitions.length === 0) throw new Error("No Fluid OS definitions found. Create one in the admin dashboard first.");
-	if (appName) {
-		const match = definitions.find((d) => d.name?.toLowerCase() === appName.toLowerCase());
-		if (!match || match.id == null) {
-			const available = definitions.map((d) => chalk.cyan(d.name ?? "(unnamed)")).join(", ");
-			throw new Error(`No definition found matching "${appName}". Available: ${available}`);
-		}
-		return {
-			id: match.id,
-			name: match.name ?? `portal-${match.id}`
-		};
-	}
+	const resolved = resolveDefinition(definitions, appName, rawDefinitionId);
+	if (resolved) return resolved;
 	const { definitionId } = await prompts({
 		type: "select",
 		name: "definitionId",
@@ -2527,9 +3304,8 @@ async function selectDefinition(client, appName) {
 		name: selected.name ?? `portal-${selected.id}`
 	};
 }
-const cloneCommand = new Command("clone").description("Clone a portal definition's provisioned GitHub repo (mints a fresh token per call)").argument("[app]", "Definition name (prompts to select when omitted)").option("--app <name>", "Definition name (same as the positional argument)").option("--dir <dir>", "Target directory (defaults to ./<slug>/)").action(async (appArg, options) => {
+const cloneCommand = new Command("clone").description("Clone a portal definition's provisioned GitHub repo (mints a fresh token per call)").argument("[app]", "Definition name (prompts to select when omitted)").option("--app <name>", "Definition name (same as the positional argument)").option("--id <id>", "Definition id (avoids ambiguity when names repeat)").option("--dir <dir>", "Target directory (defaults to ./<slug>/)").action(async (appArg, options) => {
 	try {
-		await ensureGitAvailable();
 		const token = getAuthToken();
 		if (!token) {
 			const profile = getActiveProfile();
@@ -2537,32 +3313,99 @@ const cloneCommand = new Command("clone").description("Clone a portal definition
 		}
 		const client = createClient$1(token);
 		const spinner = ora("Resolving definition…").start();
-		const definition = await selectDefinition(client, options.app ?? appArg);
+		const definition = await selectDefinition(client, options.app ?? appArg, options.id);
 		spinner.text = "Minting git credential…";
-		const outcome = await createPortalGitCredential({
+		const outcome = await createPortalGitCredentialWithRetry({
 			baseUrl: getBaseUrl(),
 			token,
-			definitionId: definition.id
+			definitionId: definition.id,
+			onRetry: ({ attempt, totalAttempts }) => {
+				spinner.text = `Preparing Git repository… retrying (${attempt}/${totalAttempts})`;
+			}
 		});
-		if (outcome.status !== "ok") {
+		if (outcome.status === "error") {
 			spinner.warn(`Can't clone — ${outcome.reason}`);
 			process.exit(1);
 		}
 		const slug = deriveSlug(definition.name);
 		const targetDir = resolve(options.dir ?? slug);
-		if (existsSync(targetDir)) {
+		if (outcome.status === "unavailable") {
+			spinner.info(gitSyncUnavailableNotice(outcome));
+			const resumeGitless = existsSync(targetDir) && await canResumeGitlessPortalScaffold(targetDir);
+			if (existsSync(targetDir) && !resumeGitless) {
+				spinner.fail(`Directory ${targetDir} already exists. Pass --dir or remove it first.`);
+				process.exit(1);
+			}
+			if (!resumeGitless) {
+				await mkdir(dirname(targetDir), { recursive: true });
+				try {
+					await mkdir(targetDir);
+				} catch (error) {
+					if (error.code === "EEXIST") {
+						spinner.fail(`Directory ${targetDir} was created by another process. Choose a different --dir or retry after it finishes.`);
+						process.exit(1);
+					}
+					throw error;
+				}
+			}
+			try {
+				spinner.text = resumeGitless ? "Resuming portal scaffold…" : "Scaffolding portal from the starter template…";
+				await scaffoldPortalProjectIntoExistingDirectory(targetDir, {
+					name: slug,
+					installDeps: false,
+					selectedPages: [],
+					profileName: getActiveProfile()?.name ?? ""
+				});
+			} catch (err) {
+				spinner.fail(`Git sync is unavailable and the local scaffold failed at ${targetDir}. Fix the reported path or permission conflict and retry.`);
+				throw err;
+			}
+			spinner.succeed(`Created ${chalk.cyan(targetDir)} from the starter template (no Git history yet)`);
+			console.log(chalk.dim(`  cd ${targetDir}`));
+			console.log(chalk.dim(`  ${chalk.cyan("fluid portal pull")} to sync content`));
+			return;
+		}
+		await ensureGitAvailable();
+		const resumeScaffold = existsSync(targetDir) && await canResumePortalScaffold(targetDir, outcome.credential.remote_url);
+		if (existsSync(targetDir) && !resumeScaffold) {
 			spinner.fail(`Directory ${targetDir} already exists. Pass --dir or remove it first.`);
 			process.exit(1);
 		}
-		spinner.text = `Cloning into ${slug}/…`;
-		try {
-			await gitClone(outcome.credential.remote_url, targetDir);
+		if (!resumeScaffold) {
+			await mkdir(dirname(targetDir), { recursive: true });
+			try {
+				await mkdir(targetDir);
+			} catch (error) {
+				if (error.code === "EEXIST") {
+					spinner.fail(`Directory ${targetDir} was created by another process. Choose a different --dir or retry after it finishes.`);
+					process.exit(1);
+				}
+				throw error;
+			}
+			spinner.text = `Cloning into ${slug}/…`;
+			try {
+				await gitClone(outcome.credential.remote_url, targetDir);
+			} catch (err) {
+				const cleanupError = await removeIncompleteCheckout(targetDir);
+				spinner.fail(cleanupError ? `git clone failed, and Fluid could not remove the incomplete checkout: ${cleanupError}` : "git clone failed; removed the incomplete checkout");
+				throw err;
+			}
+			excludeLocalStateFromGit(targetDir);
+		}
+		if (resumeScaffold || !await fileExists(join(targetDir, "package.json"))) try {
+			spinner.text = resumeScaffold ? "Resuming runnable portal scaffold…" : "Adding runnable portal scaffold…";
+			await scaffoldPortalProjectIntoExistingDirectory(targetDir, {
+				name: slug,
+				installDeps: false,
+				selectedPages: [],
+				profileName: getActiveProfile()?.name ?? ""
+			});
 		} catch (err) {
-			spinner.fail("git clone failed");
+			spinner.fail(`Repository cloned at ${targetDir}, but the runnable scaffold failed. The provisioned Git history and repository files were preserved; fix the reported path or permission conflict and retry the scaffold.`);
 			throw err;
 		}
 		spinner.succeed(`Cloned into ${chalk.cyan(targetDir)}`);
-		console.log(chalk.dim(`  cd ${slug}`));
+		console.log(chalk.dim(`  cd ${targetDir}`));
 		console.log(chalk.dim(`  ${chalk.cyan("fluid portal pull")} to sync content`));
 	} catch (error) {
 		console.log();
@@ -2770,206 +3613,19 @@ export const widgetPackage = defineWidgetPackage({
 }
 const widgetCommand = new Command("widget").description("Manage Remote DOM portal widgets").addCommand(createSubcommand);
 //#endregion
-//#region src/utils/widget-package-config.ts
-const WIDGET_CONFIG_PATH = "src/widgets.config.ts";
-const SOURCE_PACKAGE_EXTRACT_FILENAME = "extract-widget-packages.ts";
-const SOURCE_PACKAGE_OUTPUT_FILENAME = "source-widget-packages.json";
-const SOURCE_PACKAGE_OUTPUT_SENTINEL = "fluid-widget-source-packages:v1";
-const TSX_CLI_PATH = createRequire(import.meta.url).resolve("tsx/cli");
-async function resolvePortalWidgetSourceConfig(projectDir) {
-	const candidate = path.join(projectDir, WIDGET_CONFIG_PATH);
-	return await fs.pathExists(candidate) ? {
-		path: candidate,
-		relativePath: WIDGET_CONFIG_PATH
-	} : void 0;
-}
-async function loadSourceWidgetPackages(projectDir) {
-	const config = await resolvePortalWidgetSourceConfig(projectDir);
-	if (!config) return success([]);
-	let tempDir;
-	try {
-		tempDir = await createTempDirectory(projectDir);
-		const extractFile = path.join(tempDir, SOURCE_PACKAGE_EXTRACT_FILENAME);
-		const outputFile = path.join(tempDir, SOURCE_PACKAGE_OUTPUT_FILENAME);
-		await fs.writeFile(extractFile, createSourcePackageExtractorScript({
-			projectDir,
-			configPath: config.path
-		}), {
-			encoding: "utf-8",
-			flag: "wx"
-		});
-		await execa(process.execPath, [
-			TSX_CLI_PATH,
-			extractFile,
-			outputFile
-		], {
-			cwd: projectDir,
-			stdio: "pipe",
-			env: {
-				...process.env,
-				NODE_ENV: "production"
-			}
-		});
-		const outputResult = await readSourcePackageExtractorOutput(outputFile);
-		if (!outputResult.success) return outputResult;
-		const parsed = outputResult.value;
-		if (parsed.length === 0) return success([]);
-		return success(parsed);
-	} catch (err) {
-		const error = err;
-		return failure({
-			code: "CONFIG_LOAD_FAILED",
-			message: `Failed to load widget packages from ${config.relativePath}`,
-			details: error.stderr ?? error.message ?? String(err)
-		});
-	} finally {
-		if (tempDir) await fs.remove(tempDir).catch(() => {});
-	}
-}
-async function createTempDirectory(projectDir) {
-	const projectTmpDir = path.join(projectDir, ".fluid", "tmp");
-	try {
-		await fs.ensureDir(projectTmpDir);
-		return await fs.mkdtemp(path.join(projectTmpDir, "widget-packages-"));
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		throw new Error(`Unable to create project-local temporary directory at ${projectTmpDir}: ${message}`);
-	}
-}
-async function readSourcePackageExtractorOutput(outputFile) {
-	let output;
-	try {
-		output = await fs.readFile(outputFile, "utf-8");
-	} catch (err) {
-		return failure({
-			code: "CONFIG_LOAD_FAILED",
-			message: "Widget package extractor did not write an output file",
-			details: err instanceof Error ? err.message : String(err)
-		});
-	}
-	let parsed;
-	try {
-		parsed = JSON.parse(output);
-	} catch {
-		return failure({
-			code: "INVALID_FORMAT",
-			message: "Failed to parse widget package output file as JSON",
-			details: `Output was: ${output.slice(0, 200)}`
-		});
+//#region ../widget-tooling/src/errors.ts
+var WidgetToolingError = class extends Error {
+	code;
+	details;
+	diagnostics;
+	constructor(code, message, options = {}) {
+		super(message, options);
+		this.name = "WidgetToolingError";
+		this.code = code;
+		this.details = options.details;
+		this.diagnostics = options.diagnostics;
 	}
-	if (!isRecord$5(parsed) || parsed.sentinel !== SOURCE_PACKAGE_OUTPUT_SENTINEL) return failure({
-		code: "INVALID_FORMAT",
-		message: "Widget package extractor output file had an invalid sentinel"
-	});
-	if (!Array.isArray(parsed.data)) return failure({
-		code: "INVALID_FORMAT",
-		message: "Extracted widget package output is not an array",
-		details: `Expected an array, got: ${typeof parsed.data}`
-	});
-	return success(parsed.data);
-}
-function createSourcePackageExtractorScript(options) {
-	return `
-import fs from "node:fs/promises";
-import path from "node:path";
-import { createServer, normalizePath } from "vite";
-
-const SOURCE_PACKAGE_MARKER = "__fluidSourceWidgetPackage";
-const OUTPUT_SENTINEL = ${JSON.stringify(SOURCE_PACKAGE_OUTPUT_SENTINEL)};
-const projectRoot = ${JSON.stringify(options.projectDir)};
-const widgetConfigPath = ${JSON.stringify(options.configPath)};
-const outputPath = process.argv[2];
-if (!outputPath) throw new Error("Missing widget package extractor output path.");
-
-function toViteModuleId(modulePath) {
-  const relativePath = path.relative(projectRoot, modulePath);
-  if (!relativePath.startsWith("..") && !path.isAbsolute(relativePath)) {
-    return "/" + normalizePath(relativePath);
-  }
-  return normalizePath(modulePath);
-}
-
-const server = await createServer({
-  root: projectRoot,
-  mode: "production",
-  server: { middlewareMode: true },
-  appType: "custom",
-  logLevel: "error",
-  clearScreen: false,
-  resolve: {
-    conditions: ["module", "browser", "development|production"],
-  },
-  ssr: {
-    noExternal: ["@fluid-app/portal-sdk"],
-    resolve: {
-      conditions: ["module", "node", "development|production"],
-    },
-  },
-});
-
-try {
-  const widgetConfig = await server.ssrLoadModule(toViteModuleId(widgetConfigPath));
-
-  function isSourceWidgetPackage(value) {
-    return Boolean(value && typeof value === "object" && value[SOURCE_PACKAGE_MARKER] === true);
-  }
-
-  function collectSourceWidgetPackages(mod) {
-    const candidates = [
-      mod.widgetPackage,
-      ...(Array.isArray(mod.widgetPackages) ? mod.widgetPackages : []),
-      mod.default,
-    ];
-    const byPackageId = new Map();
-    for (const candidate of candidates) {
-      if (!isSourceWidgetPackage(candidate)) continue;
-      if (!byPackageId.has(candidate.packageId)) byPackageId.set(candidate.packageId, candidate);
-    }
-    return Array.from(byPackageId.values());
-  }
-
-  function serializeWidget(widget) {
-    if (!widget || typeof widget !== "object" || Array.isArray(widget)) {
-      return widget;
-    }
-    const { component, ...metadata } = widget;
-    return metadata;
-  }
-
-  function serializePackage(sourcePackage) {
-    return {
-      manifestVersion: sourcePackage.manifestVersion,
-      scope: sourcePackage.scope,
-      packageStableId: sourcePackage.packageStableId,
-      packageId: sourcePackage.packageId,
-      packageType: sourcePackage.packageType,
-      version: sourcePackage.version,
-      cssUrls: sourcePackage.cssUrls,
-      widgets: Array.isArray(sourcePackage.widgets)
-        ? sourcePackage.widgets.map(serializeWidget)
-        : sourcePackage.widgets,
-    };
-  }
-
-  await fs.writeFile(
-    outputPath,
-    JSON.stringify({
-      sentinel: OUTPUT_SENTINEL,
-      data: collectSourceWidgetPackages(widgetConfig).map(serializePackage),
-    }),
-    "utf-8",
-  );
-} finally {
-  await server.close();
-}
-`;
-}
-function isRecord$5(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-//#endregion
-//#region src/utils/widget-package-artifacts.ts
-const WIDGET_PACKAGE_BUILDER_VERSION = "1";
+};
 const CONTENT_TYPES = {
 	".css": "text/css",
 	".js": "application/javascript",
@@ -3000,7 +3656,7 @@ function createPublishManifestMetadata(options) {
 	return {
 		packageId: options.packageId,
 		version: options.version,
-		builderVersion: options.builderVersion ?? "1",
+		builderVersion: options.builderVersion ?? "0.1.0",
 		cliVersion: options.cliVersion,
 		runtimeVersion: options.runtimeVersion,
 		manifestHash: sha256(options.manifestContent),
@@ -3087,15 +3743,15 @@ function isJsonValueAtDepth(value, ancestors, depth) {
 	if (typeof value !== "object" || depth > 50 || ancestors.has(value)) return false;
 	ancestors.add(value);
 	const prototype = Object.getPrototypeOf(value);
-	const isJson = Array.isArray(value) ? value.every((item) => isJsonValueAtDepth(item, ancestors, depth + 1)) : (prototype === Object.prototype || prototype === null) && isRecord$4(value) && Object.entries(value).every(([key, item]) => !UNSAFE_JSON_KEYS.has(key) && isJsonValueAtDepth(item, ancestors, depth + 1));
+	const isJson = Array.isArray(value) ? value.every((item) => isJsonValueAtDepth(item, ancestors, depth + 1)) : (prototype === Object.prototype || prototype === null) && isRecord$5(value) && Object.entries(value).every(([key, item]) => !UNSAFE_JSON_KEYS.has(key) && isJsonValueAtDepth(item, ancestors, depth + 1));
 	ancestors.delete(value);
 	return isJson;
 }
-function isRecord$4(value) {
+function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 //#endregion
-//#region src/utils/widget-package-validation.ts
+//#region ../widget-tooling/src/internal/widget-package-validation.ts
 const URL_SAFE_SEGMENT_SOURCE = "[A-Za-z0-9][A-Za-z0-9_~-]*";
 const URL_SAFE_WIDGET_NAME_PATTERN = new RegExp(`^${URL_SAFE_SEGMENT_SOURCE}$`);
 const URL_SAFE_DOTTED_IDENTIFIER_PATTERN = new RegExp(`^${URL_SAFE_SEGMENT_SOURCE}(?:\\.${URL_SAFE_SEGMENT_SOURCE})*$`);
@@ -3134,7 +3790,17 @@ function validateSingleSourceWidgetPackage(sourcePackages, options = {}) {
 		path: "packageType",
 		message: "Widget package publish/deploy currently supports company and droplet owners. Set packageType to \"company\" or \"droplet\"."
 	});
+	else if (options.owner !== void 0 && sourcePackage.packageType !== options.owner) errors.push({
+		code: "UNSUPPORTED_OWNER",
+		path: "packageType",
+		message: `Widget package metadata must set packageType to "${options.owner}" for this workflow.`
+	});
 	const resolvedOwner = owner === "droplet" ? "droplet" : "company";
+	if (resolvedOwner === "droplet" && !readNonEmptyTrimmedString(sourcePackage.packageStableId)) errors.push({
+		code: "INVALID_PACKAGE_KEY",
+		path: "packageStableId",
+		message: "Droplet widget packages must set packageStableId so published widget types remain stable across builds."
+	});
 	const packageKey = resolvePackageKey(sourcePackage, resolvedOwner);
 	const packageKeyPath = readNonEmptyTrimmedString(sourcePackage.packageStableId) ? "packageStableId" : "packageId";
 	if (!isUrlSafeDottedIdentifier(packageKey)) errors.push({
@@ -3255,7 +3921,7 @@ function validationFailure(error) {
 	};
 }
 function validateSourcePackageShape(value) {
-	if (!isRecord$3(value)) return [{
+	if (!isRecord$4(value)) return [{
 		code: "INVALID_SOURCE_PACKAGE",
 		message: "Widget source package must be a JSON object."
 	}];
@@ -3265,6 +3931,11 @@ function validateSourcePackageShape(value) {
 	validateOptionalStringField(value, "scope", "scope", errors);
 	validateOptionalStringField(value, "packageStableId", "packageStableId", errors);
 	validateOptionalStringField(value, "packageType", "packageType", errors);
+	if (Object.prototype.hasOwnProperty.call(value, "navigationOrigins")) errors.push({
+		code: "INVALID_SOURCE_PACKAGE",
+		path: "navigationOrigins",
+		message: "navigationOrigins has been removed. Declare the externalNavigation capability and call allowAnchorUrl(url) for each external link."
+	});
 	if (value.cssUrls !== void 0) if (!Array.isArray(value.cssUrls)) errors.push({
 		code: "INVALID_SOURCE_PACKAGE",
 		path: "cssUrls",
@@ -3283,7 +3954,7 @@ function validateSourcePackageShape(value) {
 	}
 	value.widgets.forEach((widget, index) => {
 		const widgetPath = `widgets[${index}]`;
-		if (!isRecord$3(widget)) {
+		if (!isRecord$4(widget)) {
 			errors.push({
 				code: "INVALID_WIDGET_METADATA",
 				path: widgetPath,
@@ -3351,7 +4022,7 @@ function validateCssUrl(value, cssUrlPath, errors) {
 function validateOptionalJsonRecordField(record, key, path, errors) {
 	const value = record[key];
 	if (value === void 0) return;
-	if (isRecord$3(value) && isJsonValue(value)) return;
+	if (isRecord$4(value) && isJsonValue(value)) return;
 	errors.push({
 		code: "INVALID_WIDGET_METADATA",
 		path,
@@ -3372,7 +4043,7 @@ function validateOptionalCapabilities(record, key, path, errors) {
 	const names = /* @__PURE__ */ new Set();
 	value.forEach((candidate, index) => {
 		const capabilityPath = `${path}[${index}]`;
-		if (!isRecord$3(candidate)) {
+		if (!isRecord$4(candidate)) {
 			errors.push({
 				code: "INVALID_WIDGET_METADATA",
 				path: capabilityPath,
@@ -3441,7 +4112,7 @@ function normalizeContainer(value) {
 function normalizeResizable(value) {
 	if (typeof value === "boolean") return value;
 	if (value === "horizontal" || value === "vertical" || value === "both") return value;
-	if (!isRecord$3(value)) return false;
+	if (!isRecord$4(value)) return false;
 	const horizontal = value.horizontal === true;
 	const vertical = value.vertical === true;
 	if (horizontal && vertical) return "both";
@@ -3484,24 +4155,225 @@ function isUrlSafeWidgetName(value) {
 function isUrlSafeSemver(value) {
 	return SEMVER_URL_SAFE_PATTERN.test(value);
 }
-function isRecord$3(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 //#endregion
-//#region src/utils/widget-package-builder.ts
-const DEFAULT_PUBLISH_DIR = ".fluid/widget-dist";
-const DEFAULT_RUNTIME_VERSION = "1";
-const TEMP_BUILD_DIR = ".fluid/widget-build";
-const TEMP_CLI_DIR = ".fluid/tmp";
-const PROJECT_VITE_CONFIG_CANDIDATES = [
-	"vite.config.ts",
-	"vite.config.mts",
-	"vite.config.js",
-	"vite.config.mjs"
-];
-const BLOCKED_FLUID_PROJECT_PLUGIN_NAMES = ["fluid-portal-dev", "fluid-backend-dev"];
-const require = createRequire(import.meta.url);
-function validateSharedWidgetPackagePublishDir(projectDir, publishDir = DEFAULT_PUBLISH_DIR, options = {}) {
+//#region ../widget-tooling/src/internal/widget-package-config.ts
+const WIDGET_CONFIG_PATH = "src/widgets.config.ts";
+const SOURCE_PACKAGE_EXTRACT_FILENAME = "extract-widget-packages.ts";
+const SOURCE_PACKAGE_OUTPUT_FILENAME = "source-widget-packages.json";
+const SOURCE_PACKAGE_OUTPUT_SENTINEL = "fluid-widget-source-packages:v1";
+const TSX_CLI_PATH = createRequire(import.meta.url).resolve("tsx/cli");
+async function resolvePortalWidgetSourceConfig(projectDir) {
+	const candidate = path.join(projectDir, WIDGET_CONFIG_PATH);
+	return await fs.pathExists(candidate) ? {
+		path: candidate,
+		relativePath: WIDGET_CONFIG_PATH
+	} : void 0;
+}
+async function loadSourceWidgetPackages(projectDir) {
+	const config = await resolvePortalWidgetSourceConfig(projectDir);
+	if (!config) return success([]);
+	let tempDir;
+	try {
+		tempDir = await createTempDirectory(projectDir);
+		const extractFile = path.join(tempDir, SOURCE_PACKAGE_EXTRACT_FILENAME);
+		const outputFile = path.join(tempDir, SOURCE_PACKAGE_OUTPUT_FILENAME);
+		await fs.writeFile(extractFile, createSourcePackageExtractorScript({
+			projectDir,
+			configPath: config.path
+		}), {
+			encoding: "utf-8",
+			flag: "wx"
+		});
+		await execa(process.execPath, [
+			TSX_CLI_PATH,
+			extractFile,
+			outputFile
+		], {
+			cwd: projectDir,
+			stdio: "pipe",
+			env: {
+				...process.env,
+				NODE_ENV: "production"
+			}
+		});
+		const outputResult = await readSourcePackageExtractorOutput(outputFile);
+		if (!outputResult.success) return outputResult;
+		const parsed = outputResult.value;
+		if (parsed.length === 0) return success([]);
+		return success(parsed);
+	} catch (err) {
+		const error = err;
+		return failure({
+			code: "CONFIG_LOAD_FAILED",
+			message: `Failed to load widget packages from ${config.relativePath}`,
+			details: error.stderr ?? error.message ?? String(err)
+		});
+	} finally {
+		if (tempDir) await fs.remove(tempDir).catch(() => {});
+	}
+}
+async function createTempDirectory(projectDir) {
+	const projectTmpDir = path.join(projectDir, ".fluid", "tmp");
+	try {
+		await fs.ensureDir(projectTmpDir);
+		return await fs.mkdtemp(path.join(projectTmpDir, "widget-packages-"));
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`Unable to create project-local temporary directory at ${projectTmpDir}: ${message}`);
+	}
+}
+async function readSourcePackageExtractorOutput(outputFile) {
+	let output;
+	try {
+		output = await fs.readFile(outputFile, "utf-8");
+	} catch (err) {
+		return failure({
+			code: "CONFIG_LOAD_FAILED",
+			message: "Widget package extractor did not write an output file",
+			details: err instanceof Error ? err.message : String(err)
+		});
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(output);
+	} catch {
+		return failure({
+			code: "INVALID_FORMAT",
+			message: "Failed to parse widget package output file as JSON",
+			details: `Output was: ${output.slice(0, 200)}`
+		});
+	}
+	if (!isRecord$3(parsed) || parsed.sentinel !== SOURCE_PACKAGE_OUTPUT_SENTINEL) return failure({
+		code: "INVALID_FORMAT",
+		message: "Widget package extractor output file had an invalid sentinel"
+	});
+	if (!Array.isArray(parsed.data)) return failure({
+		code: "INVALID_FORMAT",
+		message: "Extracted widget package output is not an array",
+		details: `Expected an array, got: ${typeof parsed.data}`
+	});
+	return success(parsed.data);
+}
+function createSourcePackageExtractorScript(options) {
+	return `
+import fs from "node:fs/promises";
+import path from "node:path";
+import { createServer, normalizePath } from "vite";
+
+const SOURCE_PACKAGE_MARKER = "__fluidSourceWidgetPackage";
+const OUTPUT_SENTINEL = ${JSON.stringify(SOURCE_PACKAGE_OUTPUT_SENTINEL)};
+const projectRoot = ${JSON.stringify(options.projectDir)};
+const widgetConfigPath = ${JSON.stringify(options.configPath)};
+const outputPath = process.argv[2];
+if (!outputPath) throw new Error("Missing widget package extractor output path.");
+
+function toViteModuleId(modulePath) {
+  const relativePath = path.relative(projectRoot, modulePath);
+  if (!relativePath.startsWith("..") && !path.isAbsolute(relativePath)) {
+    return "/" + normalizePath(relativePath);
+  }
+  return normalizePath(modulePath);
+}
+
+const server = await createServer({
+  root: projectRoot,
+  mode: "production",
+  server: { middlewareMode: true },
+  appType: "custom",
+  logLevel: "error",
+  clearScreen: false,
+  resolve: {
+    conditions: ["module", "browser", "development|production"],
+  },
+  ssr: {
+    noExternal: ["@fluid-app/portal-sdk"],
+    resolve: {
+      conditions: ["module", "node", "development|production"],
+    },
+  },
+});
+
+try {
+  const widgetConfig = await server.ssrLoadModule(toViteModuleId(widgetConfigPath));
+
+  function isSourceWidgetPackage(value) {
+    return Boolean(value && typeof value === "object" && value[SOURCE_PACKAGE_MARKER] === true);
+  }
+
+  function collectSourceWidgetPackages(mod) {
+    const candidates = [
+      mod.widgetPackage,
+      ...(Array.isArray(mod.widgetPackages) ? mod.widgetPackages : []),
+      mod.default,
+    ];
+    const byPackageId = new Map();
+    for (const candidate of candidates) {
+      if (!isSourceWidgetPackage(candidate)) continue;
+      if (!byPackageId.has(candidate.packageId)) byPackageId.set(candidate.packageId, candidate);
+    }
+    return Array.from(byPackageId.values());
+  }
+
+  function serializeWidget(widget) {
+    if (!widget || typeof widget !== "object" || Array.isArray(widget)) {
+      return widget;
+    }
+    const { component, ...metadata } = widget;
+    return metadata;
+  }
+
+  function serializePackage(sourcePackage) {
+    return {
+      manifestVersion: sourcePackage.manifestVersion,
+      scope: sourcePackage.scope,
+      packageStableId: sourcePackage.packageStableId,
+      packageId: sourcePackage.packageId,
+      packageType: sourcePackage.packageType,
+      version: sourcePackage.version,
+      cssUrls: sourcePackage.cssUrls,
+      ...(Object.prototype.hasOwnProperty.call(sourcePackage, "navigationOrigins")
+        ? { navigationOrigins: sourcePackage.navigationOrigins }
+        : {}),
+      widgets: Array.isArray(sourcePackage.widgets)
+        ? sourcePackage.widgets.map(serializeWidget)
+        : sourcePackage.widgets,
+    };
+  }
+
+  await fs.writeFile(
+    outputPath,
+    JSON.stringify({
+      sentinel: OUTPUT_SENTINEL,
+      data: collectSourceWidgetPackages(widgetConfig).map(serializePackage),
+    }),
+    "utf-8",
+  );
+} finally {
+  await server.close();
+}
+`;
+}
+function isRecord$3(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region ../widget-tooling/src/internal/widget-package-builder.ts
+const DEFAULT_PUBLISH_DIR = ".fluid/widget-dist";
+const DEFAULT_RUNTIME_VERSION = "1";
+const TEMP_BUILD_DIR = ".fluid/widget-build";
+const TEMP_CLI_DIR = ".fluid/tmp";
+const PROJECT_VITE_CONFIG_CANDIDATES = [
+	"vite.config.ts",
+	"vite.config.mts",
+	"vite.config.js",
+	"vite.config.mjs"
+];
+const BLOCKED_FLUID_PROJECT_PLUGIN_NAMES = ["fluid-portal-dev", "fluid-backend-dev"];
+const require = createRequire(import.meta.url);
+function validateSharedWidgetPackagePublishDir(projectDir, publishDir = DEFAULT_PUBLISH_DIR, options = {}) {
 	const label = options.optionName ?? "publishDir";
 	if (path.isAbsolute(publishDir)) throw new Error(`${label} must be relative to the project directory.`);
 	const normalizedPublishDir = normalizePublishDirForValidation(publishDir);
@@ -3575,7 +4447,7 @@ async function buildSharedWidgetPackage(options) {
 		const publishManifest = createPublishManifestMetadata({
 			packageId: publishPackageId,
 			version: validation.value.version,
-			cliVersion: readCliVersion(),
+			cliVersion: options.cliVersion,
 			runtimeVersion: DEFAULT_RUNTIME_VERSION,
 			manifestContent,
 			artifacts
@@ -3873,24 +4745,6 @@ function toPosixPath(value) {
 function stableStringify(value) {
 	return `${JSON.stringify(value, null, 2)}\n`;
 }
-function readCliVersion() {
-	return resolveCliVersionFromPackageMetadata(path.dirname(fileURLToPath(import.meta.url)), require);
-}
-function resolveCliVersionFromPackageMetadata(startDir, loadPackageMetadata) {
-	for (const packageJsonPath of candidatePackageJsonPaths(startDir)) {
-		let packageJson;
-		try {
-			packageJson = loadPackageMetadata(packageJsonPath);
-		} catch (error) {
-			if (isModuleResolutionError(error)) continue;
-			throw new Error("Failed to read Fluid CLI package metadata.", { cause: error });
-		}
-		if (!isRecord$2(packageJson) || packageJson.name !== "@fluid-app/fluid-cli-portal") continue;
-		if (typeof packageJson.version !== "string" || packageJson.version.length === 0) throw new Error("Fluid CLI package metadata does not declare a valid version.");
-		return packageJson.version;
-	}
-	throw new Error("Unable to find Fluid CLI package metadata.");
-}
 function resolveViteCliPathFromRequire(moduleRequire) {
 	try {
 		const packageJsonPath = moduleRequire.resolve("vite/package.json");
@@ -3917,37 +4771,183 @@ function isNodeError(value) {
 function isModuleResolutionError(value) {
 	return isNodeError(value) && (value.code === "MODULE_NOT_FOUND" || value.code === "ERR_MODULE_NOT_FOUND");
 }
-function candidatePackageJsonPaths(startDir) {
-	const paths = [];
-	let current = startDir;
-	while (true) {
-		paths.push(path.join(current, "package.json"));
-		const parent = path.dirname(current);
-		if (parent === current) return paths;
-		current = parent;
-	}
-}
 //#endregion
-//#region src/utils/widget-package-upload.ts
-var WidgetPackageUploadError = class extends Error {
-	code;
-	constructor(code, message) {
-		super(message);
-		this.name = "WidgetPackageUploadError";
-		this.code = code;
-	}
-};
-function buildWidgetPackageArtifactPayload(artifact) {
+//#region ../widget-tooling/src/internal/widget-package-publish-request.ts
+async function createWidgetPackagePublishRequest(options) {
+	const manifestContent = await fs.readFile(options.manifestPath);
+	const manifest = parseJsonRecord(manifestContent.toString("utf-8"), options.manifestPath);
+	const publishManifest = await readPublishManifest(options.publishManifestPath);
+	assertManifestIdentityMatches(manifest, publishManifest, options.manifestPath);
+	assertMetadataMatches({
+		label: "manifestHash",
+		path: "manifest.json",
+		expected: publishManifest.manifestHash,
+		actual: sha256(manifestContent)
+	});
+	const collectedArtifacts = await collectWidgetPackageArtifacts(options.publishDir);
+	assertArtifactInventoryMatches(publishManifest.artifacts, collectedArtifacts);
+	const artifacts = await readUploadArtifacts(options.publishDir, publishManifest.artifacts);
 	return {
-		path: artifact.path,
-		sha256: artifact.sha256,
-		bytes: artifact.bytes,
-		contentType: artifact.contentType
+		version: publishManifest.version,
+		packageKey: stripOwnerPrefix(publishManifest.packageId, options.owner),
+		builderVersion: publishManifest.builderVersion,
+		cliVersion: publishManifest.cliVersion,
+		runtimeVersion: publishManifest.runtimeVersion,
+		manifestHash: publishManifest.manifestHash,
+		manifest,
+		artifacts
 	};
 }
-function buildWidgetPackageUploadSessionPayload(request) {
-	return {
-		version: request.version,
+async function readJsonRecord(filePath) {
+	return parseJsonRecord(await fs.readFile(filePath, "utf-8"), filePath);
+}
+function parseJsonRecord(content, filePath) {
+	const value = JSON.parse(content);
+	if (!isRecord$1(value) || Array.isArray(value)) throw new Error(`${path.basename(filePath)} must contain a JSON object.`);
+	return value;
+}
+async function readPublishManifest(filePath) {
+	const record = await readJsonRecord(filePath);
+	const artifactsValue = record["artifacts"];
+	if (!Array.isArray(artifactsValue)) throw new Error("publish-manifest.json must include an artifacts array.");
+	return {
+		packageId: readRequiredString(record, "packageId", filePath),
+		version: readRequiredString(record, "version", filePath),
+		builderVersion: readRequiredString(record, "builderVersion", filePath),
+		cliVersion: readRequiredString(record, "cliVersion", filePath),
+		runtimeVersion: readRequiredString(record, "runtimeVersion", filePath),
+		manifestHash: readRequiredString(record, "manifestHash", filePath),
+		artifacts: artifactsValue.map((artifact, index) => readArtifactMetadata(artifact, index))
+	};
+}
+function readArtifactMetadata(value, index) {
+	if (!isRecord$1(value) || Array.isArray(value)) throw new Error(`publish-manifest.json artifacts[${index}] must be a JSON object.`);
+	return {
+		path: readRequiredString(value, "path", "publish-manifest.json"),
+		sha256: readRequiredString(value, "sha256", "publish-manifest.json"),
+		bytes: readRequiredNumber(value, "bytes", "publish-manifest.json"),
+		contentType: readRequiredString(value, "contentType", "publish-manifest.json")
+	};
+}
+async function readUploadArtifacts(publishDir, artifacts) {
+	const resolvedPublishDir = path.resolve(publishDir);
+	return Promise.all(artifacts.map(async (artifact) => {
+		const artifactPath = resolveArtifactPath(resolvedPublishDir, artifact.path);
+		const actual = await computeArtifactMetadata(artifactPath, resolvedPublishDir);
+		assertArtifactMetadataMatches(artifact, actual);
+		return {
+			...actual,
+			body: await fs.readFile(artifactPath)
+		};
+	}));
+}
+function assertManifestIdentityMatches(manifest, publishManifest, manifestPath) {
+	assertMetadataMatches({
+		label: "packageId",
+		path: "manifest.json",
+		expected: publishManifest.packageId,
+		actual: readRequiredString(manifest, "packageId", manifestPath)
+	});
+	assertMetadataMatches({
+		label: "version",
+		path: "manifest.json",
+		expected: publishManifest.version,
+		actual: readRequiredString(manifest, "version", manifestPath)
+	});
+}
+function assertArtifactInventoryMatches(expected, actual) {
+	const expectedByPath = /* @__PURE__ */ new Map();
+	for (const artifact of expected) {
+		if (expectedByPath.has(artifact.path)) throw new Error(`publish-manifest.json artifacts include duplicate path ${JSON.stringify(artifact.path)}. Rebuild the widget package before publishing.`);
+		expectedByPath.set(artifact.path, artifact);
+	}
+	const actualPaths = /* @__PURE__ */ new Set();
+	for (const actualArtifact of actual) {
+		actualPaths.add(actualArtifact.path);
+		const expectedArtifact = expectedByPath.get(actualArtifact.path);
+		if (!expectedArtifact) throw new Error(`publish-manifest.json artifacts omit ${JSON.stringify(actualArtifact.path)}. Rebuild the widget package before publishing.`);
+		assertArtifactMetadataMatches(expectedArtifact, actualArtifact);
+	}
+	for (const expectedArtifact of expected) {
+		if (actualPaths.has(expectedArtifact.path)) continue;
+		throw new Error(`publish-manifest.json artifacts include ${JSON.stringify(expectedArtifact.path)}, but that file is not present on disk. Rebuild the widget package before publishing.`);
+	}
+}
+function assertArtifactMetadataMatches(expected, actual) {
+	assertMetadataMatches({
+		label: "path",
+		path: expected.path,
+		expected: expected.path,
+		actual: actual.path
+	});
+	assertMetadataMatches({
+		label: "sha256",
+		path: expected.path,
+		expected: expected.sha256,
+		actual: actual.sha256
+	});
+	assertMetadataMatches({
+		label: "bytes",
+		path: expected.path,
+		expected: expected.bytes,
+		actual: actual.bytes
+	});
+	assertMetadataMatches({
+		label: "contentType",
+		path: expected.path,
+		expected: expected.contentType,
+		actual: actual.contentType
+	});
+}
+function assertMetadataMatches(options) {
+	if (options.expected === options.actual) return;
+	throw new Error(`publish-manifest.json ${options.label} for ${JSON.stringify(options.path)} does not match the file on disk. Recorded ${JSON.stringify(options.expected)}, computed ${JSON.stringify(options.actual)}. Rebuild the widget package before publishing.`);
+}
+function resolveArtifactPath(publishDir, artifactPath) {
+	const resolved = path.resolve(publishDir, artifactPath);
+	const relative = path.relative(publishDir, resolved);
+	if (relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`Artifact path ${JSON.stringify(artifactPath)} escapes the publish directory.`);
+	return resolved;
+}
+function stripOwnerPrefix(packageId, owner) {
+	const prefix = `${owner}.`;
+	if (packageId.startsWith(prefix) && packageId.length > prefix.length) return packageId.slice(prefix.length);
+	return packageId;
+}
+function readRequiredString(record, key, filePath) {
+	const value = record[key];
+	if (typeof value === "string" && value.trim().length > 0) return value;
+	throw new Error(`${path.basename(filePath)} must include string ${key}.`);
+}
+function readRequiredNumber(record, key, filePath) {
+	const value = record[key];
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+	throw new Error(`${path.basename(filePath)} must include number ${key}.`);
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null;
+}
+//#endregion
+//#region ../widget-tooling/src/internal/widget-package-upload.ts
+var WidgetPackageUploadError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "WidgetPackageUploadError";
+		this.code = code;
+	}
+};
+function buildWidgetPackageArtifactPayload(artifact) {
+	return {
+		path: artifact.path,
+		sha256: artifact.sha256,
+		bytes: artifact.bytes,
+		contentType: artifact.contentType
+	};
+}
+function buildWidgetPackageUploadSessionPayload(request) {
+	return {
+		version: request.version,
 		package_key: request.packageKey,
 		builder_version: request.builderVersion,
 		cli_version: request.cliVersion,
@@ -4100,10 +5100,10 @@ function mergeUploadHeaders(headers, contentType) {
 	return merged;
 }
 function requireRecord(value, code, message) {
-	if (!isRecord$1(value) || Array.isArray(value)) throw new WidgetPackageUploadError(code, message);
+	if (!isRecord(value) || Array.isArray(value)) throw new WidgetPackageUploadError(code, message);
 	return value;
 }
-function isRecord$1(value) {
+function isRecord(value) {
 	return typeof value === "object" && value !== null;
 }
 function requireStringProperty(record, key, code) {
@@ -4123,7 +5123,7 @@ function requireStringArrayProperty(record, key, code) {
 }
 function formatUnknownError(err) {
 	const base = err instanceof Error ? err.message : String(err);
-	if (isRecord$1(err) && "data" in err) return `${base} — ${safeStringify(err.data)}`;
+	if (isRecord(err) && "data" in err) return `${base} — ${safeStringify(err.data)}`;
 	return base;
 }
 function safeStringify(value) {
@@ -4141,73 +5141,100 @@ function safeStringify(value) {
 	}
 }
 //#endregion
+//#region ../widget-tooling/src/workflows.ts
+async function buildWidgetPackage(options) {
+	const result = await buildSharedWidgetPackage({
+		projectDir: options.projectDir,
+		publishDir: options.outDir,
+		owner: options.owner,
+		cliVersion: options.cliVersion
+	});
+	if (result.success) return result.value;
+	throw new WidgetToolingError(result.error.code === "CONFIG_LOAD_FAILED" ? "CONFIG_LOAD_FAILED" : result.error.code === "VALIDATION_FAILED" ? "VALIDATION_FAILED" : result.error.code === "INVALID_PUBLISH_DIR" ? "INVALID_OUTPUT_DIR" : "BUILD_FAILED", result.error.message, { details: result.error.details });
+}
+async function publishWidgetPackage(options) {
+	if (options.owner !== options.uploadOwner.kind) throw new WidgetToolingError("OWNER_MISMATCH", `Widget package build owner "${options.owner}" must match upload owner kind "${options.uploadOwner.kind}".`);
+	if (!options.dryRun && !options.client) throw new WidgetToolingError("CLIENT_REQUIRED", "A FetchClient is required when dryRun is false.");
+	const build = await buildWidgetPackage(options);
+	let request;
+	try {
+		request = await createWidgetPackagePublishRequest({
+			publishDir: build.publishDir,
+			manifestPath: build.manifestPath,
+			publishManifestPath: build.publishManifestPath,
+			owner: options.owner
+		});
+	} catch (error) {
+		throw new WidgetToolingError("ARTIFACT_VERIFICATION_FAILED", error instanceof Error ? error.message : "Failed to verify widget package artifacts.", { cause: error });
+	}
+	try {
+		const publish = options.dryRun ? await publishWidgetPackageVersion({
+			owner: options.uploadOwner,
+			request,
+			dryRun: true,
+			fetchImpl: options.fetchImpl
+		}) : await publishWidgetPackageVersion({
+			client: options.client,
+			owner: options.uploadOwner,
+			request,
+			fetchImpl: options.fetchImpl
+		});
+		return {
+			build,
+			request,
+			publish
+		};
+	} catch (error) {
+		if (error instanceof WidgetToolingError) throw error;
+		if (error instanceof WidgetPackageUploadError) throw new WidgetToolingError(toPublicUploadErrorCode(error.code), error.message, { cause: error });
+		throw new WidgetToolingError("PUBLISH_FAILED", error instanceof Error ? error.message : "Failed to publish widget package.", { cause: error });
+	}
+}
+function toPublicUploadErrorCode(code) {
+	switch (code) {
+		case "SESSION_REQUEST_FAILED":
+		case "INVALID_SESSION_RESPONSE":
+		case "MISSING_SIGNED_URL":
+		case "CONTENT_TYPE_MISMATCH":
+		case "ARTIFACT_UPLOAD_FAILED":
+		case "COMPLETE_UPLOAD_FAILED":
+		case "INVALID_COMPLETE_RESPONSE": return code;
+		default: return "PUBLISH_FAILED";
+	}
+}
+//#endregion
 //#region src/commands/widget-package-publish.ts
-async function publishWidgetRuntimeArtifacts(options, dependencies = {}) {
-	const buildPackage = dependencies.buildSharedWidgetPackage ?? buildSharedWidgetPackage;
-	const publishVersion = dependencies.publishWidgetPackageVersion ?? publishWidgetPackageVersion;
+async function publishWidgetRuntimeArtifacts(options) {
 	const isDryRun = options.dryRun === true;
 	const client = options.client;
 	if (!isDryRun && !client) throw new Error("A FetchClient is required when dryRun is false.");
-	const safeOutDir = validateWidgetPublishOutDir(options.projectDir, options.outDir);
-	const buildResult = await buildPackage({
-		projectDir: options.projectDir,
-		publishDir: safeOutDir,
-		owner: options.buildOwner
-	});
-	if (!buildResult.success) {
-		const details = buildResult.error.details ? `\n${buildResult.error.details}` : "";
-		throw new Error(`${buildResult.error.message}${details}`);
-	}
-	const request = await createWidgetPackagePublishRequest({
-		publishDir: buildResult.value.publishDir,
-		manifestPath: buildResult.value.manifestPath,
-		publishManifestPath: buildResult.value.publishManifestPath,
-		owner: options.buildOwner
-	});
-	let publish;
-	if (isDryRun) publish = await publishVersion({
-		owner: options.uploadOwner,
-		request,
-		dryRun: true
-	});
-	else {
+	const cliVersion = await getPortalCliVersion();
+	try {
+		if (isDryRun) return await publishWidgetPackage({
+			projectDir: options.projectDir,
+			outDir: options.outDir,
+			owner: options.buildOwner,
+			uploadOwner: options.uploadOwner,
+			cliVersion,
+			dryRun: true
+		});
 		if (!client) throw new Error("A FetchClient is required when dryRun is false.");
-		publish = await publishVersion({
-			client,
-			owner: options.uploadOwner,
-			request
+		return await publishWidgetPackage({
+			projectDir: options.projectDir,
+			outDir: options.outDir,
+			owner: options.buildOwner,
+			uploadOwner: options.uploadOwner,
+			cliVersion,
+			client
 		});
+	} catch (error) {
+		throwWithDetails(error);
 	}
-	return {
-		build: buildResult.value,
-		request,
-		publish
-	};
 }
-async function createWidgetPackagePublishRequest(options) {
-	const manifestContent = await fs.readFile(options.manifestPath);
-	const manifest = parseJsonRecord(manifestContent.toString("utf-8"), options.manifestPath);
-	const publishManifest = await readPublishManifest(options.publishManifestPath);
-	assertManifestIdentityMatches(manifest, publishManifest, options.manifestPath);
-	assertMetadataMatches({
-		label: "manifestHash",
-		path: "manifest.json",
-		expected: publishManifest.manifestHash,
-		actual: sha256(manifestContent)
-	});
-	const collectedArtifacts = await collectWidgetPackageArtifacts(options.publishDir);
-	assertArtifactInventoryMatches(publishManifest.artifacts, collectedArtifacts);
-	const artifacts = await readUploadArtifacts(options.publishDir, publishManifest.artifacts);
-	return {
-		version: publishManifest.version,
-		packageKey: stripOwnerPrefix(publishManifest.packageId, options.owner),
-		builderVersion: publishManifest.builderVersion,
-		cliVersion: publishManifest.cliVersion,
-		runtimeVersion: publishManifest.runtimeVersion,
-		manifestHash: publishManifest.manifestHash,
-		manifest,
-		artifacts
-	};
+function throwWithDetails(error) {
+	if (!(error instanceof Error)) throw error;
+	if (!("details" in error) || typeof error.details !== "string" || error.details.length === 0) throw error;
+	throw new Error(`${error.message}\n${error.details}`, { cause: error });
 }
 function createAuthenticatedWidgetPackageClient() {
 	const { profile, profileName, token } = resolveAuthenticatedProfile();
@@ -4261,139 +5288,6 @@ function printDryRunSessionPayload(result) {
 	console.log(JSON.stringify(result.publish.sessionPayload, null, 2));
 	console.log();
 }
-function validateWidgetPublishOutDir(projectDir, outDir) {
-	validateSharedWidgetPackagePublishDir(projectDir, outDir, { optionName: "--out-dir" });
-	return outDir;
-}
-async function readJsonRecord(filePath) {
-	return parseJsonRecord(await fs.readFile(filePath, "utf-8"), filePath);
-}
-function parseJsonRecord(content, filePath) {
-	const value = JSON.parse(content);
-	if (!isRecord(value) || Array.isArray(value)) throw new Error(`${path.basename(filePath)} must contain a JSON object.`);
-	return value;
-}
-async function readPublishManifest(filePath) {
-	const record = await readJsonRecord(filePath);
-	const artifactsValue = record["artifacts"];
-	if (!Array.isArray(artifactsValue)) throw new Error("publish-manifest.json must include an artifacts array.");
-	return {
-		packageId: readRequiredString(record, "packageId", filePath),
-		version: readRequiredString(record, "version", filePath),
-		builderVersion: readRequiredString(record, "builderVersion", filePath),
-		cliVersion: readRequiredString(record, "cliVersion", filePath),
-		runtimeVersion: readRequiredString(record, "runtimeVersion", filePath),
-		manifestHash: readRequiredString(record, "manifestHash", filePath),
-		artifacts: artifactsValue.map((artifact, index) => readArtifactMetadata(artifact, index))
-	};
-}
-function readArtifactMetadata(value, index) {
-	if (!isRecord(value) || Array.isArray(value)) throw new Error(`publish-manifest.json artifacts[${index}] must be a JSON object.`);
-	return {
-		path: readRequiredString(value, "path", "publish-manifest.json"),
-		sha256: readRequiredString(value, "sha256", "publish-manifest.json"),
-		bytes: readRequiredNumber(value, "bytes", "publish-manifest.json"),
-		contentType: readRequiredString(value, "contentType", "publish-manifest.json")
-	};
-}
-async function readUploadArtifacts(publishDir, artifacts) {
-	const resolvedPublishDir = path.resolve(publishDir);
-	return Promise.all(artifacts.map(async (artifact) => {
-		const artifactPath = resolveArtifactPath(resolvedPublishDir, artifact.path);
-		const actual = await computeArtifactMetadata(artifactPath, resolvedPublishDir);
-		assertArtifactMetadataMatches(artifact, actual);
-		return {
-			...actual,
-			body: await fs.readFile(artifactPath)
-		};
-	}));
-}
-function assertManifestIdentityMatches(manifest, publishManifest, manifestPath) {
-	assertMetadataMatches({
-		label: "packageId",
-		path: "manifest.json",
-		expected: publishManifest.packageId,
-		actual: readRequiredString(manifest, "packageId", manifestPath)
-	});
-	assertMetadataMatches({
-		label: "version",
-		path: "manifest.json",
-		expected: publishManifest.version,
-		actual: readRequiredString(manifest, "version", manifestPath)
-	});
-}
-function assertArtifactInventoryMatches(expected, actual) {
-	const expectedByPath = /* @__PURE__ */ new Map();
-	for (const artifact of expected) {
-		if (expectedByPath.has(artifact.path)) throw new Error(`publish-manifest.json artifacts include duplicate path ${JSON.stringify(artifact.path)}. Rebuild the widget package before publishing.`);
-		expectedByPath.set(artifact.path, artifact);
-	}
-	const actualPaths = /* @__PURE__ */ new Set();
-	for (const actualArtifact of actual) {
-		actualPaths.add(actualArtifact.path);
-		const expectedArtifact = expectedByPath.get(actualArtifact.path);
-		if (!expectedArtifact) throw new Error(`publish-manifest.json artifacts omit ${JSON.stringify(actualArtifact.path)}. Rebuild the widget package before publishing.`);
-		assertArtifactMetadataMatches(expectedArtifact, actualArtifact);
-	}
-	for (const expectedArtifact of expected) {
-		if (actualPaths.has(expectedArtifact.path)) continue;
-		throw new Error(`publish-manifest.json artifacts include ${JSON.stringify(expectedArtifact.path)}, but that file is not present on disk. Rebuild the widget package before publishing.`);
-	}
-}
-function assertArtifactMetadataMatches(expected, actual) {
-	assertMetadataMatches({
-		label: "path",
-		path: expected.path,
-		expected: expected.path,
-		actual: actual.path
-	});
-	assertMetadataMatches({
-		label: "sha256",
-		path: expected.path,
-		expected: expected.sha256,
-		actual: actual.sha256
-	});
-	assertMetadataMatches({
-		label: "bytes",
-		path: expected.path,
-		expected: expected.bytes,
-		actual: actual.bytes
-	});
-	assertMetadataMatches({
-		label: "contentType",
-		path: expected.path,
-		expected: expected.contentType,
-		actual: actual.contentType
-	});
-}
-function assertMetadataMatches(options) {
-	if (options.expected === options.actual) return;
-	throw new Error(`publish-manifest.json ${options.label} for ${JSON.stringify(options.path)} does not match the file on disk. Recorded ${JSON.stringify(options.expected)}, computed ${JSON.stringify(options.actual)}. Rebuild the widget package before publishing.`);
-}
-function resolveArtifactPath(publishDir, artifactPath) {
-	const resolved = path.resolve(publishDir, artifactPath);
-	const relative = path.relative(publishDir, resolved);
-	if (relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(`Artifact path ${JSON.stringify(artifactPath)} escapes the publish directory.`);
-	return resolved;
-}
-function stripOwnerPrefix(packageId, owner) {
-	const prefix = `${owner}.`;
-	if (packageId.startsWith(prefix) && packageId.length > prefix.length) return packageId.slice(prefix.length);
-	return packageId;
-}
-function readRequiredString(record, key, filePath) {
-	const value = record[key];
-	if (typeof value === "string" && value.trim().length > 0) return value;
-	throw new Error(`${path.basename(filePath)} must include string ${key}.`);
-}
-function readRequiredNumber(record, key, filePath) {
-	const value = record[key];
-	if (typeof value === "number" && Number.isFinite(value)) return value;
-	throw new Error(`${path.basename(filePath)} must include number ${key}.`);
-}
-function isRecord(value) {
-	return typeof value === "object" && value !== null;
-}
 //#endregion
 //#region src/commands/deploy.ts
 const DEFAULT_OUT_DIR$1 = ".fluid/widget-dist";
@@ -4793,6 +5687,6 @@ const plugin = {
 	}
 };
 //#endregion
-export { CANONICAL_PROJECT_NAME, FILE_SYSTEM_ERRORS, GitError, TEMPLATES, TEMPLATE_REPO_URL, WIDGET_PACKAGE_BUILDER_VERSION, WidgetPackageUploadError, buildIdToSlugMap, buildNavigationIdToSlugMap, buildSharedWidgetPackage, buildSnapshot, buildThemeIdToSlugMap, buildWidgetPackageCompleteUploadPayload, buildWidgetPackagePublishManifest, buildWidgetPackageUploadSessionPayload, categorizeChanges, cloneCommand, collectWidgetPackageArtifacts, completeWidgetPackageUpload, computeArtifactMetadata, computeFileHash, copyTemplate, copyTemplateSafe, createAuthenticatedWidgetPackageClient, createCommand, createDirectory, createDirectorySafe, createPortalGitCredential, createPortalProject, createPublishManifestMetadata, createWidgetPackageEntrySource, createWidgetPackagePublishRequest, plugin as default, deployCommand, deriveScreenSlug, deriveSlug, diffAgainstSnapshot, directoryExists, doctorCommand, ensureGitAvailable, fileExists, getArtifactContentType, getInstallCommand, getOriginUrl, getRunCommand, getSdkVersion, getSdkVersionSafe, getTemplatePaths, getWidgetPackageCompleteUploadRoute, getWidgetPackageUploadSessionRoute, gitAheadBehindVsFetchHead, gitAutoCommit, gitClone, gitFetch, gitInit, gitMergeFastForward, gitMissingError, gitPush, hasUncommittedChanges, installDependencies, isGitAvailable, isGitRepo, loadSourceWidgetPackages, normalizeWidgetPackageCompleteResponse, normalizeWidgetPackageUploadSession, pathExists, portalGitCredentialPath, printDryRunSessionPayload, printRuntimeOnlyNotice, printWidgetPublishSummary, promptProjectConfig, publishWidgetPackageVersion, publishWidgetRuntimeArtifacts, pullCommand, pushCommand, readFileSafe, readMappings, readSnapshot, removeMapping, requestWidgetPackageUploadSession, resolveIdToSlug, resolvePortalWidgetSourceConfig, resolveSlugToId, rewriteProjectName, runPackageManager, runPortalGitSync, scaffoldFromGitHub, sha256, slugFromPath, topLevelWidgetCommand, transformNavigation, transformNavigationItems, transformProfile, transformScreen, transformTheme, updateMapping, uploadWidgetPackageArtifacts, validateCrossReferences, validateSingleSourceWidgetPackage, validateWidgetPublishOutDir, versionCommand, widgetCommand, writeFileSafe, writeFluidrcProfile, writeMappings, writeSnapshot };
+export { CANONICAL_PROJECT_NAME, FILE_SYSTEM_ERRORS, GitError, TEMPLATES, TEMPLATE_REPO_URL, buildIdToSlugMap, buildNavigationIdToSlugMap, buildSnapshot, buildThemeIdToSlugMap, categorizeChanges, cloneCommand, computeFileHash, copyTemplate, copyTemplateSafe, createCommand, createDirectory, createDirectorySafe, createPortalGitCredential, createPortalProject, plugin as default, deployCommand, deriveScreenSlug, deriveSlug, diffAgainstSnapshot, directoryExists, doctorCommand, ensureGitAvailable, fileExists, getInstallCommand, getOriginUrl, getRunCommand, getSdkVersion, getSdkVersionSafe, getTemplatePaths, gitAheadBehindVsFetchHead, gitAutoCommit, gitClone, gitFetch, gitInit, gitMergeFastForward, gitMissingError, gitPush, hasUncommittedChanges, installDependencies, isGitAvailable, isGitRepo, pathExists, portalGitCredentialPath, promptProjectConfig, pullCommand, pushCommand, readFileSafe, readMappings, readSnapshot, removeMapping, resolveIdToSlug, resolveSlugToId, rewriteProjectName, runPackageManager, runPortalGitSync, scaffoldFromGitHub, slugFromPath, topLevelWidgetCommand, transformNavigation, transformNavigationItems, transformProfile, transformScreen, transformTheme, updateMapping, validateCrossReferences, versionCommand, widgetCommand, writeFileSafe, writeFluidrcProfile, writeMappings, writeSnapshot };
 
 //# sourceMappingURL=index.mjs.map